5f7a7924e445d2f77382fb783658871b170c21c5c43fa9c8f789549fd9792d36 | Triage

Sharing

General

Target

5f7a7924e445d2f77382fb783658871b170c21c5c43fa9c8f789549fd9792d36
Size

127KB
Sample

221125-wdhaysgc7t
MD5

fd318949a730d43c24490ff520799508
SHA1

31b5f0888105fd0a39d02a6ebf2705e7a7285e76
SHA256

5f7a7924e445d2f77382fb783658871b170c21c5c43fa9c8f789549fd9792d36
SHA512

bcc1c76b6291bc0a4b8f28af6f789bd0093a9acc8a42fb8665b3dd769d95cd4b623d2101cc96aae8d43efa89964fc381a69bea57ca05309a74580dff9152a3fa
SSDEEP

3072:+zireMNALp+CSYnzyHyvBwwQlF9KwrrzFmwzDqrRIe:+zeeMspaYzyHeBzQJPrrpHKrKe

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
- Size
  
  176KB
- MD5
  
  0bdbb242c3d65c99b0c4b3bdad19a793
- SHA1
  
  1b2a37b64b1a7ca71b801125faca273408bb7e67
- SHA256
  
  942b643d07c0cb4ac1593dccd846fe4bcda402f5f74fa4ba1437248e7c89e0c3
- SHA512
  
  387c6455dc286989d0de8b418505b5453ce82c262132eba2975006b59057a698bb5fe33bfa428690d0db30b3396ba6b699a1ad2b68482bc04df27975ca19206e
- SSDEEP
  
  3072:bBfHcmI+fMEJRvGGs4Edlb9kMv0UNLp+CSYnzyZyvBwwQlF9KwrrznF19AaROhze:blH80NJ5ZEdT8UlpaYzyZeBzQJPrrjFt
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2