4bbf30ae82b3d83268242e0b9eb28018ac5bb7f6ce36d769667467d68ca67649 | Triage

Sharing

General

Target

4bbf30ae82b3d83268242e0b9eb28018ac5bb7f6ce36d769667467d68ca67649
Size

75KB
Sample

221123-rp8vtscb9y
MD5

9aa77160d87d64a7c7f060fffe8dee79
SHA1

34f4099d2f90036e976b3796d070182985c4c2ad
SHA256

4bbf30ae82b3d83268242e0b9eb28018ac5bb7f6ce36d769667467d68ca67649
SHA512

bc3e5af2397d0ec0eda0c8c3b61db420200eb6d8dc3e9c084757f1a73cd5c74933816e7dcfc1424712411855a4fe3c96e7c4378b75dfccb94ee6a9047ede9a6a
SSDEEP

768:kLgb35mRKx8FmJCO8RVZs1vwMmFYrMewAf3vmv3L0+9j0M/s6gKbo:kLglsrZDEbMe7f38J9O6gK

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  4bbf30ae82b3d83268242e0b9eb28018ac5bb7f6ce36d769667467d68ca67649
- Size
  
  75KB
- MD5
  
  9aa77160d87d64a7c7f060fffe8dee79
- SHA1
  
  34f4099d2f90036e976b3796d070182985c4c2ad
- SHA256
  
  4bbf30ae82b3d83268242e0b9eb28018ac5bb7f6ce36d769667467d68ca67649
- SHA512
  
  bc3e5af2397d0ec0eda0c8c3b61db420200eb6d8dc3e9c084757f1a73cd5c74933816e7dcfc1424712411855a4fe3c96e7c4378b75dfccb94ee6a9047ede9a6a
- SSDEEP
  
  768:kLgb35mRKx8FmJCO8RVZs1vwMmFYrMewAf3vmv3L0+9j0M/s6gKbo:kLglsrZDEbMe7f38J9O6gK
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2