ea34fddc91a6eed52056288b80e2ffdaeb4035e9edf50258aaef755dda1fbcf2 | Triage

Sharing

General

Target

ea34fddc91a6eed52056288b80e2ffdaeb4035e9edf50258aaef755dda1fbcf2
Size

92KB
Sample

221123-p1z1ysfg6v
MD5

fd55371aa914bbd65abe4af0523c7ca3
SHA1

c42255e14231cdf57dd490758bc966dc7746133d
SHA256

ea34fddc91a6eed52056288b80e2ffdaeb4035e9edf50258aaef755dda1fbcf2
SHA512

b6b23543664154134fbaf9ceac07baddbb93c8a4f329dcc251f5147d38365940b6c23bea6be59acdba63fe619007871f7df7c41f38a0c55097e733171e4b32b7
SSDEEP

1536:Xkmz1bGXIxTqwCR5c7FcDYPLv8gDEgRol:UqyX4Uc7FtPomEgRu

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  ea34fddc91a6eed52056288b80e2ffdaeb4035e9edf50258aaef755dda1fbcf2
- Size
  
  92KB
- MD5
  
  fd55371aa914bbd65abe4af0523c7ca3
- SHA1
  
  c42255e14231cdf57dd490758bc966dc7746133d
- SHA256
  
  ea34fddc91a6eed52056288b80e2ffdaeb4035e9edf50258aaef755dda1fbcf2
- SHA512
  
  b6b23543664154134fbaf9ceac07baddbb93c8a4f329dcc251f5147d38365940b6c23bea6be59acdba63fe619007871f7df7c41f38a0c55097e733171e4b32b7
- SSDEEP
  
  1536:Xkmz1bGXIxTqwCR5c7FcDYPLv8gDEgRol:UqyX4Uc7FtPomEgRu
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2