11707df99f5b7fd1ee4b9b31d6e28a6c4211a2d5b04b8c59d0bf081964d0a082 | Triage

Sharing

General

Target

11707df99f5b7fd1ee4b9b31d6e28a6c4211a2d5b04b8c59d0bf081964d0a082
Size

126KB
Sample

221124-ey47saca8t
MD5

c6e3a7a7887c95fa6c3802bb79545c57
SHA1

b4de629e40d7924a21fbec8ba42a49540a0fac10
SHA256

11707df99f5b7fd1ee4b9b31d6e28a6c4211a2d5b04b8c59d0bf081964d0a082
SHA512

28d14a7ca582079722e5743a0ec7255e58d1c5e23bd4c88dbeb7375036bb3a53d8d61a2551e3e75e3608bb6d04c51e0417c09894122e3810f249eb76a008ddb3
SSDEEP

3072:kRUGgqRxKNnpXtAVR6Li2ikZSYbmlpSchjDeb0McnnW:oUG7ANn9Oy7ZS9h2YxnW

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
- Size
  
  168KB
- MD5
  
  91291b0c1fb27cff77c5a7731807abf0
- SHA1
  
  0cdd5dcdf23c65136faf067d55a098f1fb93469f
- SHA256
  
  ede3136fd45a022bb470ff9a2752d4b48c641e1fe6ddc4aa5fa3a414b6921b95
- SHA512
  
  65632a66c7cb3fdbdf0e89de5298b378597e96e8a1a96f232669dd7a70235b428b45f529f6175555ea67ad987dbdfade0697b3ee440bfebf9a473db3279b490a
- SSDEEP
  
  3072:pVmADg66x5y7FuW3jLi2ikZSYbmlpSchjDeL8lOW+9d+zr3/1C:pVA665pW3Z7ZS9h2LjOM
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2