5bdde7cd853ff81962309e63f0a39cb1b1fa6b439e0b6212a7c003ffa1b7fb84 | Triage

Sharing

General

Target

5bdde7cd853ff81962309e63f0a39cb1b1fa6b439e0b6212a7c003ffa1b7fb84
Size

204KB
Sample

221123-vmt6facd3z
MD5

ca91f21ee7be2a71b07f24c3b8ff7d0c
SHA1

47885f460058459522be92d77c458f58bcd4fb0c
SHA256

5bdde7cd853ff81962309e63f0a39cb1b1fa6b439e0b6212a7c003ffa1b7fb84
SHA512

b0a2126a8c354d7ec16bb2a5b866cd144032b078617d74bf298ce84162b017044802b15047ddc0ae2b6e3bbe8ac6630bcca9801e13600911d8989a851d3e4f64
SSDEEP

3072:/UQvOOFRWi3u85nDcU+zg8heFJ/NaUo9pHH8yX2wGPTVHHFaK6eNL:zhBbnDcvg8hq/poF2wG7VnFaKL

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  5bdde7cd853ff81962309e63f0a39cb1b1fa6b439e0b6212a7c003ffa1b7fb84
- Size
  
  204KB
- MD5
  
  ca91f21ee7be2a71b07f24c3b8ff7d0c
- SHA1
  
  47885f460058459522be92d77c458f58bcd4fb0c
- SHA256
  
  5bdde7cd853ff81962309e63f0a39cb1b1fa6b439e0b6212a7c003ffa1b7fb84
- SHA512
  
  b0a2126a8c354d7ec16bb2a5b866cd144032b078617d74bf298ce84162b017044802b15047ddc0ae2b6e3bbe8ac6630bcca9801e13600911d8989a851d3e4f64
- SSDEEP
  
  3072:/UQvOOFRWi3u85nDcU+zg8heFJ/NaUo9pHH8yX2wGPTVHHFaK6eNL:zhBbnDcvg8hq/poF2wG7VnFaKL
Score

7^/10

persistence
- Drops startup file
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2