c07a04e4bd7fe2a1e6d1cb0bb76ee5c59e7210c57db1ac367e0f910a17f1e973 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c07a04e4bd7fe2a1e6d1cb0bb76ee5c59e7210c57db1ac367e0f910a17f1e973
Size

142KB
Sample

221106-s5mg7sbhbk
MD5

048487315b9aedd79c53c821a12d8851
SHA1

ab8dd754cc58e43de9d5df2887c5d04c30701cf3
SHA256

c07a04e4bd7fe2a1e6d1cb0bb76ee5c59e7210c57db1ac367e0f910a17f1e973
SHA512

6ce05a83b06c49baed7d227ebaff9e2efda43656ba310e1de9821bace9326bfe16797ccfd41ddfa0dec9e54f3d9b5927256e0d060936b2251a91eb612f7dba17
SSDEEP

3072:+mOv2+yeiyayBHxbN/I6xak/RHnkDBdq1W8fX1jMwhsj:+1v9iyaaxe6xaERHkolX1MO

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  c07a04e4bd7fe2a1e6d1cb0bb76ee5c59e7210c57db1ac367e0f910a17f1e973
- Size
  
  142KB
- MD5
  
  048487315b9aedd79c53c821a12d8851
- SHA1
  
  ab8dd754cc58e43de9d5df2887c5d04c30701cf3
- SHA256
  
  c07a04e4bd7fe2a1e6d1cb0bb76ee5c59e7210c57db1ac367e0f910a17f1e973
- SHA512
  
  6ce05a83b06c49baed7d227ebaff9e2efda43656ba310e1de9821bace9326bfe16797ccfd41ddfa0dec9e54f3d9b5927256e0d060936b2251a91eb612f7dba17
- SSDEEP
  
  3072:+mOv2+yeiyayBHxbN/I6xak/RHnkDBdq1W8fX1jMwhsj:+1v9iyaaxe6xaERHkolX1MO
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2