364d786dbe6596f0b23814187f154ac4dc8d28b446d33d92b4670a4d56a50116 | Triage

Sharing

General

Target

prova.vshost.exe
Size

5KB
Sample

221125-r8tv1seg59
MD5

d2215fdd1d8bfe53999ab611795d6ccd
SHA1

dd04969f232820643dd3f5c0a172df1c5cd55a7b
SHA256

364d786dbe6596f0b23814187f154ac4dc8d28b446d33d92b4670a4d56a50116
SHA512

254c3c29cbfc98c558297ac29b5da65864a8318a705a629b386792fb980679e04b1f9746113621767446ca67659fe190312dd3aaabc8809f612e292c4d0f145e
SSDEEP

96:5PBYHguj2xvpafD3KrDbdYzYbgQfWO0VmWgO:5I1SxB8zYbgQfWO0VmWj

Score

6^/10

microsoft persistence phishing

Malware Config

Targets

- Target
  
  prova.vshost.exe
- Size
  
  5KB
- MD5
  
  d2215fdd1d8bfe53999ab611795d6ccd
- SHA1
  
  dd04969f232820643dd3f5c0a172df1c5cd55a7b
- SHA256
  
  364d786dbe6596f0b23814187f154ac4dc8d28b446d33d92b4670a4d56a50116
- SHA512
  
  254c3c29cbfc98c558297ac29b5da65864a8318a705a629b386792fb980679e04b1f9746113621767446ca67659fe190312dd3aaabc8809f612e292c4d0f145e
- SSDEEP
  
  96:5PBYHguj2xvpafD3KrDbdYzYbgQfWO0VmWgO:5I1SxB8zYbgQfWO0VmWj
Score

6^/10

microsoft persistence phishing
- Adds Run key to start application
  persistence
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

microsoftpersistencephishing