ae0a6a1b203390b236aa9b12f3e266000014f899a784bd3489a9b5c20a3cb134 | Triage

Sharing

General

Target

ae0a6a1b203390b236aa9b12f3e266000014f899a784bd3489a9b5c20a3cb134
Size

137KB
Sample

221124-zl5yrscc9w
MD5

6d2bc1cf44cf3aa92553ae9dab3f9ab5
SHA1

59d2ec447d65e742fad1570ae429e124ede97f27
SHA256

ae0a6a1b203390b236aa9b12f3e266000014f899a784bd3489a9b5c20a3cb134
SHA512

67b1c00f7883790e8b2da2a99c4cca969361ada740cd9a82463dd3be8352aa881e509ef09b669b4a3fecdfbb214757890d94dcbbc16f364397ffd3a3fb577942
SSDEEP

1536:ROyiGUJJXGPteKPNA3aBn+ry5f1HyHvbnMJ4LDVXCH10ZhGqtGFoVRsF:ROOUnf6n+ry5f1SP7MJ48+GwGARsF

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  ae0a6a1b203390b236aa9b12f3e266000014f899a784bd3489a9b5c20a3cb134
- Size
  
  137KB
- MD5
  
  6d2bc1cf44cf3aa92553ae9dab3f9ab5
- SHA1
  
  59d2ec447d65e742fad1570ae429e124ede97f27
- SHA256
  
  ae0a6a1b203390b236aa9b12f3e266000014f899a784bd3489a9b5c20a3cb134
- SHA512
  
  67b1c00f7883790e8b2da2a99c4cca969361ada740cd9a82463dd3be8352aa881e509ef09b669b4a3fecdfbb214757890d94dcbbc16f364397ffd3a3fb577942
- SSDEEP
  
  1536:ROyiGUJJXGPteKPNA3aBn+ry5f1HyHvbnMJ4LDVXCH10ZhGqtGFoVRsF:ROOUnf6n+ry5f1SP7MJ48+GwGARsF
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Deletes itself
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2