3ddf0abe134f351257d9b794ac4fb2424646fe55d77d11d7af2d6df4a015aea5 | Triage

Sharing

General

Target

3ddf0abe134f351257d9b794ac4fb2424646fe55d77d11d7af2d6df4a015aea5
Size

280KB
Sample

221107-qtrlnshfh5
MD5

0852ebe4950dc5c01e81e123cb20f5d0
SHA1

1aeb77ea59355c6747a66be43e20916f3fde215d
SHA256

3ddf0abe134f351257d9b794ac4fb2424646fe55d77d11d7af2d6df4a015aea5
SHA512

35974817a670f932c8c0ecedd0b15f5d884b3d85e7383736271106f68815d130243947cc8d0bfd61bcb8d6c32975453a9f4b58b31373405bd5ed76c4f51adbb1
SSDEEP

6144:pT8lj6/LTbJ8j7q4qFNLG0mvT0YhBdF5VWiFDL6u:pgleTZe7q4eNLS0YXdFBv6

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  3ddf0abe134f351257d9b794ac4fb2424646fe55d77d11d7af2d6df4a015aea5
- Size
  
  280KB
- MD5
  
  0852ebe4950dc5c01e81e123cb20f5d0
- SHA1
  
  1aeb77ea59355c6747a66be43e20916f3fde215d
- SHA256
  
  3ddf0abe134f351257d9b794ac4fb2424646fe55d77d11d7af2d6df4a015aea5
- SHA512
  
  35974817a670f932c8c0ecedd0b15f5d884b3d85e7383736271106f68815d130243947cc8d0bfd61bcb8d6c32975453a9f4b58b31373405bd5ed76c4f51adbb1
- SSDEEP
  
  6144:pT8lj6/LTbJ8j7q4qFNLG0mvT0YhBdF5VWiFDL6u:pgleTZe7q4eNLS0YXdFBv6
Score

8^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence