e0f25a2ac3ada78a560de6f651fe5d59f17e3948c6b5dc36f67a3e200775d16d | Triage

Sharing

General

Target

e0f25a2ac3ada78a560de6f651fe5d59f17e3948c6b5dc36f67a3e200775d16d
Size

227KB
Sample

221123-k29jkadd5y
MD5

4782afaa8f95e9b3b09d5049720bd6fc
SHA1

d1ade740968ba4ba339ac78df36a24afa21d9eaa
SHA256

e0f25a2ac3ada78a560de6f651fe5d59f17e3948c6b5dc36f67a3e200775d16d
SHA512

cb8e25d3c5181718e92626c81944896c2056f876b92635cc0f52541333e185e37711f6efd601f5237426d751bf739abdc86b2fe020cb8e1c20b4669e6cf2f2b1
SSDEEP

3072:UXCiLk7ndEFIp8d94jVS1CzyySvS9uhvqkH3njNJz6sjB/PyzFfIE/GtH5c6hRzi:U4YI09oS1C+yi0kX8l65c6VF+FbYzH1k

Score

6^/10

persistence

Malware Config

Targets

- Target
  
  e0f25a2ac3ada78a560de6f651fe5d59f17e3948c6b5dc36f67a3e200775d16d
- Size
  
  227KB
- MD5
  
  4782afaa8f95e9b3b09d5049720bd6fc
- SHA1
  
  d1ade740968ba4ba339ac78df36a24afa21d9eaa
- SHA256
  
  e0f25a2ac3ada78a560de6f651fe5d59f17e3948c6b5dc36f67a3e200775d16d
- SHA512
  
  cb8e25d3c5181718e92626c81944896c2056f876b92635cc0f52541333e185e37711f6efd601f5237426d751bf739abdc86b2fe020cb8e1c20b4669e6cf2f2b1
- SSDEEP
  
  3072:UXCiLk7ndEFIp8d94jVS1CzyySvS9uhvqkH3njNJz6sjB/PyzFfIE/GtH5c6hRzi:U4YI09oS1C+yi0kX8l65c6VF+FbYzH1k
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2