bf7cdda5dabe1d7646fc4f294e64de4650c135304c930bee417878d0ad1a1cef | Triage

Sharing

General

Target

bf7cdda5dabe1d7646fc4f294e64de4650c135304c930bee417878d0ad1a1cef
Size

63KB
Sample

221123-s8wkaadc88
MD5

a90c3b86ed6caef004eeb4760be76ac6
SHA1

4d434a86ee52295d4cc3b39614634c0a9d8aa7b4
SHA256

bf7cdda5dabe1d7646fc4f294e64de4650c135304c930bee417878d0ad1a1cef
SHA512

185cdd7baf3402471b3c6067dc531a28aff523a70f19584fed0636852d29fdbedbf6cdad2be5d6cd504fc02565f4a30a4b6966efe805101cb6fd6042da3c5d20
SSDEEP

1536:fzqISh/pJLd7I8w1Tfsgdewzc3jB0XVfSNlhkpBZZhdZWXx:f1TsKMkFSNE7hdA

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  bf7cdda5dabe1d7646fc4f294e64de4650c135304c930bee417878d0ad1a1cef
- Size
  
  63KB
- MD5
  
  a90c3b86ed6caef004eeb4760be76ac6
- SHA1
  
  4d434a86ee52295d4cc3b39614634c0a9d8aa7b4
- SHA256
  
  bf7cdda5dabe1d7646fc4f294e64de4650c135304c930bee417878d0ad1a1cef
- SHA512
  
  185cdd7baf3402471b3c6067dc531a28aff523a70f19584fed0636852d29fdbedbf6cdad2be5d6cd504fc02565f4a30a4b6966efe805101cb6fd6042da3c5d20
- SSDEEP
  
  1536:fzqISh/pJLd7I8w1Tfsgdewzc3jB0XVfSNlhkpBZZhdZWXx:f1TsKMkFSNE7hdA
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2