c15ce6c922b115423121179c0cc5ed19a130e966e240ce51e38ec58ebfad5ff7 | Triage

Sharing

General

Target

c15ce6c922b115423121179c0cc5ed19a130e966e240ce51e38ec58ebfad5ff7
Size

121KB
Sample

221124-exvlysbh9s
MD5

37ecda47cf90396457f91e50ccec110d
SHA1

1175e656204ca392fe23fbe193fdb9ed4c237a80
SHA256

c15ce6c922b115423121179c0cc5ed19a130e966e240ce51e38ec58ebfad5ff7
SHA512

0b1bb7913aa5ebe040c0a1b5220a2e1f12cd852d51bc746aa5af4b615396a0f9dba7e50df007521e0544031a4f120cd5d9890765f37cbf598c402e80241c505a
SSDEEP

3072:w/EVJukPSszLgdOoDbj78dYHvbCQpLtf4P4H3rzQ:yEVVPTzwHDbNvuQtlH3HQ

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
- Size
  
  152KB
- MD5
  
  fa2f4d553195f26107bb14dd6bd1336f
- SHA1
  
  afc4088979a8de48bc06f921ffcddec35716b00c
- SHA256
  
  6d9e4d239cebe3c438a2c9a582afbc6d8d06f45fc5fd00b7aed6591d9826c276
- SHA512
  
  12c2343d8a7385fb1ea9e7b46ee47216cc53445ab40b9708450adb044dcdbf470b9140620de071206a95446ef801fe7cb7164f8a822cd6f4c22a7777b50a2595
- SSDEEP
  
  3072:+PUPz54mYWpWUGgYWancdOoDbj78duHvbCQpLtfCczU+vA6VtfROjVmd+zr3/1Q2:AuGmDGPQHDbZvuQtNzU+v3ML
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2