635983613ae7b518b4920dd142d0c3d44dbd5f6cfe04ecfd979d61e68dd25632 | Triage

Sharing

General

Target

635983613ae7b518b4920dd142d0c3d44dbd5f6cfe04ecfd979d61e68dd25632
Size

240KB
Sample

221123-k26snsdd5v
MD5

166947acf0e9f45c7bf5945ecb94cf38
SHA1

5d66a29df5792d72e04514f6c2c3188d7f16693e
SHA256

635983613ae7b518b4920dd142d0c3d44dbd5f6cfe04ecfd979d61e68dd25632
SHA512

7b2ffd4558c2706b47c712a2bf6ea602a0e15968056ffe79569671fc7c6b56d20bc2bd91a84adac0f95e8ddf9b3026d1ddaf6a12abda874a142bec1f7238440a
SSDEEP

6144:iwossuEKC5eG+K2leoarpwFxCNYo6B3zD:voRhPseoarPx6h

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  635983613ae7b518b4920dd142d0c3d44dbd5f6cfe04ecfd979d61e68dd25632
- Size
  
  240KB
- MD5
  
  166947acf0e9f45c7bf5945ecb94cf38
- SHA1
  
  5d66a29df5792d72e04514f6c2c3188d7f16693e
- SHA256
  
  635983613ae7b518b4920dd142d0c3d44dbd5f6cfe04ecfd979d61e68dd25632
- SHA512
  
  7b2ffd4558c2706b47c712a2bf6ea602a0e15968056ffe79569671fc7c6b56d20bc2bd91a84adac0f95e8ddf9b3026d1ddaf6a12abda874a142bec1f7238440a
- SSDEEP
  
  6144:iwossuEKC5eG+K2leoarpwFxCNYo6B3zD:voRhPseoarPx6h
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Modifies WinLogon
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2