ed43b673c00debf663f71272e10611254f99043bd3be0ce4f7448f312d4eb6b0 | Triage

Sharing

General

Target

first_penetration_hymen_after_school_torn_vagina_photo.ZIP
Size

2.0MB
Sample

221122-ct188aff38
MD5

69a3f6494032829599c72139dd874dbd
SHA1

8ce93f30bdc360a5ec79a5f232296837ae86cb2b
SHA256

ed43b673c00debf663f71272e10611254f99043bd3be0ce4f7448f312d4eb6b0
SHA512

4139ba7efccb8a7337e2259c6461e36f823c3ecce6a2046aa8fba8ce25bbedaf8765419d7513c7ecd934cea964ea17948285c28a493a1a6bf43a504635cf4b96
SSDEEP

24576:C/KjtmFumtcAMASvlvondeJSh55xDpFMuLR4VbpWN44C43f/jbpmY0M:CS5LyQlAn5hJrnR4mCgf/jbUY0M

Score

8^/10

Malware Config

Targets

- Target
  
  first_penetration_hymen_after_school_torn_vagina_photo.msi
- Size
  
  493.7MB
- MD5
  
  f30e0a07ab31aa82a9014d8626aa69a4
- SHA1
  
  01da449c5ad5ff2ee9809a6ca45ef768805df7c0
- SHA256
  
  72b098b0759c48d9a26366813435366cc4cb1d3017fe5952c3c5443d7372ec00
- SHA512
  
  bc8d013135d65a79160a99c28fadce46279f216520ec2662afafd3d686d50e99d6e4ac5d95cbd33e438e11cb18116379dc8c2931f08abae67b7b6c2917acf5d4
- SSDEEP
  
  24576:ckqW3m8d0IWpxnKrxLWg3sz88e7fh498+txBxotbD7+eoYBsQ0kaJFub7e:lvm89pHrh49ZtaJPzB29FQ7e
Score

8^/10
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2