794129e6525495a01d888ac4f03378fc6dc7f48abf842c1af7dd455a201ac49c | Triage

Sharing

General

Target

794129e6525495a01d888ac4f03378fc6dc7f48abf842c1af7dd455a201ac49c
Size

125KB
Sample

221107-pepyvsheek
MD5

0d877e5596148ea2518276010d825392
SHA1

6673b830650834db609dbcaff8c6bedb77bd701e
SHA256

794129e6525495a01d888ac4f03378fc6dc7f48abf842c1af7dd455a201ac49c
SHA512

16fcd229c5bc7f8a5ddb1096b6169581ee3efee203b8a027f0ba914d4796d6b5aaa418e83f90a862f530d838c0be8861a394a2496b8a4a3bea1a52f85bb4c9eb
SSDEEP

3072:T3tNkPGemOiwVn8ixLBlzies0k1NLYMm6oa+mUpsW:Td4mOpthY1lYMBGp

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  794129e6525495a01d888ac4f03378fc6dc7f48abf842c1af7dd455a201ac49c
- Size
  
  125KB
- MD5
  
  0d877e5596148ea2518276010d825392
- SHA1
  
  6673b830650834db609dbcaff8c6bedb77bd701e
- SHA256
  
  794129e6525495a01d888ac4f03378fc6dc7f48abf842c1af7dd455a201ac49c
- SHA512
  
  16fcd229c5bc7f8a5ddb1096b6169581ee3efee203b8a027f0ba914d4796d6b5aaa418e83f90a862f530d838c0be8861a394a2496b8a4a3bea1a52f85bb4c9eb
- SSDEEP
  
  3072:T3tNkPGemOiwVn8ixLBlzies0k1NLYMm6oa+mUpsW:Td4mOpthY1lYMBGp
Score

10^/10

evasion persistence
- Modifies security service
  evasion
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2