94639f6a2b23298f5d6c1050c09b185606c1010260a4974be24cae68ffee3456 | Triage

Sharing

General

Target

94639f6a2b23298f5d6c1050c09b185606c1010260a4974be24cae68ffee3456
Size

144KB
Sample

221107-nsfrnsgdan
MD5

0616a5fdd5ea6c2e4dda217eb45f5439
SHA1

29a96c2a2111920757eb76a15ef7a674a899e150
SHA256

94639f6a2b23298f5d6c1050c09b185606c1010260a4974be24cae68ffee3456
SHA512

10cffeb5972dead07ad4781efc2b09e5809e164fd5873396af70f512c2806dfc2a48613113e2542bf25ed81e15938e5eb9b65b0d88e89288e9000a1521a75dbb
SSDEEP

3072:zAr7XvVgyG22sUHsWvDvTWMlxfFj9WnIfypmm5DygXQqLZQ5X0V92ol:z87XdZG2rUH5v7Xl/j4oypxtOl0Vr

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  94639f6a2b23298f5d6c1050c09b185606c1010260a4974be24cae68ffee3456
- Size
  
  144KB
- MD5
  
  0616a5fdd5ea6c2e4dda217eb45f5439
- SHA1
  
  29a96c2a2111920757eb76a15ef7a674a899e150
- SHA256
  
  94639f6a2b23298f5d6c1050c09b185606c1010260a4974be24cae68ffee3456
- SHA512
  
  10cffeb5972dead07ad4781efc2b09e5809e164fd5873396af70f512c2806dfc2a48613113e2542bf25ed81e15938e5eb9b65b0d88e89288e9000a1521a75dbb
- SSDEEP
  
  3072:zAr7XvVgyG22sUHsWvDvTWMlxfFj9WnIfypmm5DygXQqLZQ5X0V92ol:z87XdZG2rUH5v7Xl/j4oypxtOl0Vr
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2