9b877f4fd3d4aa077c070ea8abd66562bf91c6ece15991543e7dfbb1c5d8ae11 | Triage

Sharing

General

Target

9b877f4fd3d4aa077c070ea8abd66562bf91c6ece15991543e7dfbb1c5d8ae11
Size

127KB
Sample

221123-qt5hjahh4x
MD5

116aad38e1cf8b075eceb6bcd9ebc668
SHA1

aa94dcba43c0799a56e533d0529d18cc2783b17c
SHA256

9b877f4fd3d4aa077c070ea8abd66562bf91c6ece15991543e7dfbb1c5d8ae11
SHA512

82ff1b7cbbe7180602f17cdf8375842588b3adc5d9d684ae039d88ed9f7d36e2d102cd935f6392a5e67730b7598512737284267e3bdcf827884776490c0448f0
SSDEEP

3072:bNgvbVcnXC6pQw6bPucRkbFyVOfEgcBCFEJyCa7UaqlFfcPc:0bV0n+w6bPuLFyj7jlMc

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  9b877f4fd3d4aa077c070ea8abd66562bf91c6ece15991543e7dfbb1c5d8ae11
- Size
  
  127KB
- MD5
  
  116aad38e1cf8b075eceb6bcd9ebc668
- SHA1
  
  aa94dcba43c0799a56e533d0529d18cc2783b17c
- SHA256
  
  9b877f4fd3d4aa077c070ea8abd66562bf91c6ece15991543e7dfbb1c5d8ae11
- SHA512
  
  82ff1b7cbbe7180602f17cdf8375842588b3adc5d9d684ae039d88ed9f7d36e2d102cd935f6392a5e67730b7598512737284267e3bdcf827884776490c0448f0
- SSDEEP
  
  3072:bNgvbVcnXC6pQw6bPucRkbFyVOfEgcBCFEJyCa7UaqlFfcPc:0bV0n+w6bPuLFyj7jlMc
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Deletes itself
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2