899e4f849a7927043e2d7c539bf55b2eff245a31e43942b964c54f1e087f1246 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

899e4f849a7927043e2d7c539bf55b2eff245a31e43942b964c54f1e087f1246
Size

300KB
Sample

221107-zkjn5sghd3
MD5

06218fd68513c0dc287a3c522596b6a0
SHA1

47f5038ff2819a466b61a6ce8acb87f20e1e505d
SHA256

899e4f849a7927043e2d7c539bf55b2eff245a31e43942b964c54f1e087f1246
SHA512

7c525e26da256354d1a3747b95ce9b8d48798befdf0950de7a67fd4eecfde63df113293c9b06ef16c67c1681d80c58bb226c6978fe8809b9e46f4e8ef4d0f72f
SSDEEP

3072:nXO42vo4rUc+WdvohlclLtLjc+F3lywxXLLNjLSYrB5a4TqmOpSpkc9E2acwJg:sBUqaclLtf9xXLtfacVp

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  899e4f849a7927043e2d7c539bf55b2eff245a31e43942b964c54f1e087f1246
- Size
  
  300KB
- MD5
  
  06218fd68513c0dc287a3c522596b6a0
- SHA1
  
  47f5038ff2819a466b61a6ce8acb87f20e1e505d
- SHA256
  
  899e4f849a7927043e2d7c539bf55b2eff245a31e43942b964c54f1e087f1246
- SHA512
  
  7c525e26da256354d1a3747b95ce9b8d48798befdf0950de7a67fd4eecfde63df113293c9b06ef16c67c1681d80c58bb226c6978fe8809b9e46f4e8ef4d0f72f
- SSDEEP
  
  3072:nXO42vo4rUc+WdvohlclLtLjc+F3lywxXLLNjLSYrB5a4TqmOpSpkc9E2acwJg:sBUqaclLtf9xXLtfacVp
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2