f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0 | Triage

Sharing

General

Target

f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0
Size

140KB
Sample

221124-vjeatabf91
MD5

e25b989b80f9ec7344754fe47828f8d3
SHA1

134653a26c79ec48c2ccfa1c9bb855e4fdb1cd25
SHA256

f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0
SHA512

ebd662b8dc895a15708c2af4148bef8baf9a971ee9a07cbe8a9195a8381955946825d2a5574c47ded991998c766f8c350f1057501266e77bf637b2bce41711e1
SSDEEP

1536:yOyiGUJJXGPteKPNA3aBn+ryflYTbHyHvbnMJ4LIfN+AzaNPPRu+RsA:yOOUnf6n+ryfuTbSP7MJ4mPzaZ/RsA

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0
- Size
  
  140KB
- MD5
  
  e25b989b80f9ec7344754fe47828f8d3
- SHA1
  
  134653a26c79ec48c2ccfa1c9bb855e4fdb1cd25
- SHA256
  
  f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0
- SHA512
  
  ebd662b8dc895a15708c2af4148bef8baf9a971ee9a07cbe8a9195a8381955946825d2a5574c47ded991998c766f8c350f1057501266e77bf637b2bce41711e1
- SSDEEP
  
  1536:yOyiGUJJXGPteKPNA3aBn+ryflYTbHyHvbnMJ4LIfN+AzaNPPRu+RsA:yOOUnf6n+ryfuTbSP7MJ4mPzaZ/RsA
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence