f9c434625b0cfe2112cdaa7f819bbcee29ba23d04908276056f126db0b85a30b | Triage

Sharing

General

Target

f9c434625b0cfe2112cdaa7f819bbcee29ba23d04908276056f126db0b85a30b
Size

218KB
Sample

221123-pvtlzscc78
MD5

8cfa357a5ac5d288f54d74f7e30cadcd
SHA1

3a1205f2a30e68b715daefe68459ecb5bdae9164
SHA256

f9c434625b0cfe2112cdaa7f819bbcee29ba23d04908276056f126db0b85a30b
SHA512

bb408ff48e7a00a88086625a350d90db29143168a60c258d050e74d071fa5cf465bd6a7e20299fe837d490bd68008b50df7246b51cc4bf2322c2991b14738321
SSDEEP

3072:sQsCOibMsuRUwy6DeCMdH2AYMsRPyqJkd6xO5UFXDV+2oF5IIU6h77OUjecgOZ/h:sFibMsidDeJdL8P5kg05w+2+O2eLVlY

Score

6^/10

persistence

Malware Config

Targets

- Target
  
  f9c434625b0cfe2112cdaa7f819bbcee29ba23d04908276056f126db0b85a30b
- Size
  
  218KB
- MD5
  
  8cfa357a5ac5d288f54d74f7e30cadcd
- SHA1
  
  3a1205f2a30e68b715daefe68459ecb5bdae9164
- SHA256
  
  f9c434625b0cfe2112cdaa7f819bbcee29ba23d04908276056f126db0b85a30b
- SHA512
  
  bb408ff48e7a00a88086625a350d90db29143168a60c258d050e74d071fa5cf465bd6a7e20299fe837d490bd68008b50df7246b51cc4bf2322c2991b14738321
- SSDEEP
  
  3072:sQsCOibMsuRUwy6DeCMdH2AYMsRPyqJkd6xO5UFXDV+2oF5IIU6h77OUjecgOZ/h:sFibMsidDeJdL8P5kg05w+2+O2eLVlY
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2