eab11c228577d1563a5d7a3f0d452a72ca74c04fb52ecc781aa22903e75d5dce | Triage

Sharing

General

Target

eab11c228577d1563a5d7a3f0d452a72ca74c04fb52ecc781aa22903e75d5dce
Size

118KB
Sample

221124-k7e7xagd4s
MD5

16256d9868dd4e728c64b1dcc323e2a9
SHA1

5f0a9a346e5aebbeb940e5304b53a847f62fd69f
SHA256

eab11c228577d1563a5d7a3f0d452a72ca74c04fb52ecc781aa22903e75d5dce
SHA512

75a566686c9fd4b18b5e78bff8d50a82a12c4d70c0716b4af615288336c79b20274c78c7a30eff50df6373c8ddba70a89bc3e39fe15d1c49f6a2c82cf2297765
SSDEEP

3072:1vis9yKT2qhQkGmgb6/d3JHfI5NxwCshg0eOFmv9:1vJ4KiaQkG7Gv/IzbyeOUF

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
- Size
  
  148KB
- MD5
  
  69a462f5962e03c6dc1d34b3ec702ef7
- SHA1
  
  42a898eb901252f9839b3376e91c80eb508ecf40
- SHA256
  
  7cad924cac4762e897aa2d5406cf63083e9d44d86f61cdde86946e0419746a2c
- SHA512
  
  252f8baabb0f160c2886b8d781a55ac747fc443029428929e52d42974eb8bbcc362181b8813c45a91d21dde405859943dd59d148d5f4bb04a5e44e02cca9260f
- SSDEEP
  
  3072:xQ/LFEPXCmqhQkGmgb6/d33HfI5NxwCshg0e4FeV3q0E:iTePXBaQkG7G5/Izbye4oVq0
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2