d96e53648bd8b742584a4a7b5c12c71e2671d553c4edc3bc75ae6c69c5f1b8c7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d96e53648bd8b742584a4a7b5c12c71e2671d553c4edc3bc75ae6c69c5f1b8c7
Size

176KB
Sample

221107-z1zqashga9
MD5

0add3138ffb8b8395729b65beada44e0
SHA1

e4bd252dddeb2911316a824df206721aab9f4b48
SHA256

d96e53648bd8b742584a4a7b5c12c71e2671d553c4edc3bc75ae6c69c5f1b8c7
SHA512

52114b758d07c91a2508653494978a005e42689eb7c23f60406b0320ba03f482834b174d9871ee71f95768db4a4a3958abf453539f099159cab940b222ee4a13
SSDEEP

1536:4jk6Dwdg28ez4+pmxiHA8f1zwQVgvQmG:4j+dg28ez4iAc1zwLvQmG

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  d96e53648bd8b742584a4a7b5c12c71e2671d553c4edc3bc75ae6c69c5f1b8c7
- Size
  
  176KB
- MD5
  
  0add3138ffb8b8395729b65beada44e0
- SHA1
  
  e4bd252dddeb2911316a824df206721aab9f4b48
- SHA256
  
  d96e53648bd8b742584a4a7b5c12c71e2671d553c4edc3bc75ae6c69c5f1b8c7
- SHA512
  
  52114b758d07c91a2508653494978a005e42689eb7c23f60406b0320ba03f482834b174d9871ee71f95768db4a4a3958abf453539f099159cab940b222ee4a13
- SSDEEP
  
  1536:4jk6Dwdg28ez4+pmxiHA8f1zwQVgvQmG:4j+dg28ez4iAc1zwLvQmG
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2