ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea | Triage

Sharing

General

Target

ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea
Size

43KB
Sample

221123-lrn1jscb25
MD5

73cb1fe83ef1db409a7eb16b87bd81fa
SHA1

1f8c16c109b245da9c551ba8b524ba24d1e57648
SHA256

ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea
SHA512

fc45d94c0c536dd9968ca27d74385bf8372c64f81dcf51b78196519d77c5a00228c379eafcdd5f5b527e8375e571626879c4ba6905497717ca0b00b3c3609d3a
SSDEEP

768:3PJadenAqtYQnaXH96rV2kllriFqR7Atmqfvfj7sMC72ZWzFwKF/KpplA:3PnAClrVLTrEqNAxvXsf7rzV/KpXA

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea
- Size
  
  43KB
- MD5
  
  73cb1fe83ef1db409a7eb16b87bd81fa
- SHA1
  
  1f8c16c109b245da9c551ba8b524ba24d1e57648
- SHA256
  
  ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea
- SHA512
  
  fc45d94c0c536dd9968ca27d74385bf8372c64f81dcf51b78196519d77c5a00228c379eafcdd5f5b527e8375e571626879c4ba6905497717ca0b00b3c3609d3a
- SSDEEP
  
  768:3PJadenAqtYQnaXH96rV2kllriFqR7Atmqfvfj7sMC72ZWzFwKF/KpplA:3PnAClrVLTrEqNAxvXsf7rzV/KpXA
Score

8^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence