eb9cb1eef858f0e09f4084181a2544baa326d329e46012e6e85fbebf742c900d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb9cb1eef858f0e09f4084181a2544baa326d329e46012e6e85fbebf742c900d
Size

5.0MB
Sample

221127-ezmzwshf44
MD5

f80fcee0a9fdecd66df8428385100d9e
SHA1

780c2114672ed48f28b42f04b4ee28b1854ba892
SHA256

eb9cb1eef858f0e09f4084181a2544baa326d329e46012e6e85fbebf742c900d
SHA512

7766e49ba255df6c5845dc94e0938672ced4573f74428dc7d456ae3599e46416cf251963cd42cfdf0bc3fc6b54dfb8a8d5e36aac3a6fce79521792b715540681
SSDEEP

98304:OcwpyrX/Q+MpxCgtuVrKCd3dbO3cQSqpOkn1w:OcwYbI+WCWu1lqfr1

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  eb9cb1eef858f0e09f4084181a2544baa326d329e46012e6e85fbebf742c900d
- Size
  
  5.0MB
- MD5
  
  f80fcee0a9fdecd66df8428385100d9e
- SHA1
  
  780c2114672ed48f28b42f04b4ee28b1854ba892
- SHA256
  
  eb9cb1eef858f0e09f4084181a2544baa326d329e46012e6e85fbebf742c900d
- SHA512
  
  7766e49ba255df6c5845dc94e0938672ced4573f74428dc7d456ae3599e46416cf251963cd42cfdf0bc3fc6b54dfb8a8d5e36aac3a6fce79521792b715540681
- SSDEEP
  
  98304:OcwpyrX/Q+MpxCgtuVrKCd3dbO3cQSqpOkn1w:OcwYbI+WCWu1lqfr1
Score

8^/10

discovery persistence
- Blocklisted process makes network request
- Modifies AppInit DLL entries
  persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence