28b6d1a4ee0a9177e4194f09ac4c157f55589cfa137f4b90ebf04620bf25f87d | Triage

Sharing

General

Target

28b6d1a4ee0a9177e4194f09ac4c157f55589cfa137f4b90ebf04620bf25f87d
Size

378KB
Sample

221123-r32cxaac88
MD5

6b5d08cd9f7a0709f259657bb2b0668d
SHA1

9ffd7711f4bf51bdcfd079b06c64ec12c83d4f00
SHA256

28b6d1a4ee0a9177e4194f09ac4c157f55589cfa137f4b90ebf04620bf25f87d
SHA512

22e04fd86212fec3acf36ddd32690ce80e2ba83be0c16776c72ecbb6ec9081fbd74afa319a2a79307c705ce5f062b84f5b6a97e8ead895c3d14b90c6bac94f2d
SSDEEP

3072:gnjFDUYY1tKvF4c7yoke8606093wDwUcpr+dkI2zM5Q:gnj1ItZoke8d9gUrpzkG

Score

6^/10

persistence

Malware Config

Targets

- Target
  
  28b6d1a4ee0a9177e4194f09ac4c157f55589cfa137f4b90ebf04620bf25f87d
- Size
  
  378KB
- MD5
  
  6b5d08cd9f7a0709f259657bb2b0668d
- SHA1
  
  9ffd7711f4bf51bdcfd079b06c64ec12c83d4f00
- SHA256
  
  28b6d1a4ee0a9177e4194f09ac4c157f55589cfa137f4b90ebf04620bf25f87d
- SHA512
  
  22e04fd86212fec3acf36ddd32690ce80e2ba83be0c16776c72ecbb6ec9081fbd74afa319a2a79307c705ce5f062b84f5b6a97e8ead895c3d14b90c6bac94f2d
- SSDEEP
  
  3072:gnjFDUYY1tKvF4c7yoke8606093wDwUcpr+dkI2zM5Q:gnj1ItZoke8d9gUrpzkG
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2