83ad27fd5004c2d605fe72755708e27de8ec295004e2d16c2e5c9b8b68ed35bd | Triage

Sharing

General

Target

83ad27fd5004c2d605fe72755708e27de8ec295004e2d16c2e5c9b8b68ed35bd
Size

212KB
Sample

221124-lwebxaeh93
MD5

162a53deb69a8b8b369b5673f0ad0fb6
SHA1

55b0076b29bddffd1876949c3e4a04f58284355e
SHA256

83ad27fd5004c2d605fe72755708e27de8ec295004e2d16c2e5c9b8b68ed35bd
SHA512

8639275b0c1e44698d7915cd9fa37ccd1275931219801322702256ea5c8dbaa4748da77bcccd8be2a2f4075b40e455fc5c4c0d8e0c0b2158f760ad845dede94e
SSDEEP

6144:nm/fER1d54wmGtDKP2nAjLRUCeNS9PRnLciB+fNiXwnL1NG:nm/f+dRm8CjdNanNiXi1NG

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.pdf.exe
- Size
  
  284KB
- MD5
  
  5227780e4555ca60025d107d5baea9dd
- SHA1
  
  73caffd3824697f8686250ef6e6c4ac12ab39252
- SHA256
  
  a34dc2d8bfe4df50efffa7f78da986024d6a0822c035ccbac2b68b995a8c35a5
- SHA512
  
  b141e79f076f019bf852f6cd1a5a1c302410294fdb3d1eec4b11b9ed615f76ac1a3c636190fc5d02a4b1b52c0bb9b7d475b7dc92fa7b81b795f715e9fa6b69d4
- SSDEEP
  
  6144:1oYT0BiwUyoqwx658IIIOf1G4ELtrWWiz0Lm1+V+XjMSBaf/9:1oY+z8Byb+Xvw
Score

7^/10

persistence discovery
- Deletes itself
- Adds Run key to start application
  persistence
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence