18b191412c0499399256febff5efb224e9c6462fb4a2db13f42265fadbb8f8c3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18b191412c0499399256febff5efb224e9c6462fb4a2db13f42265fadbb8f8c3
Size

597KB
Sample

221127-hm6g9abf61
MD5

b03a199a7a84f394aea26e212a5ecae1
SHA1

7e4ce30e88839063c99343009bcd210dd61db568
SHA256

18b191412c0499399256febff5efb224e9c6462fb4a2db13f42265fadbb8f8c3
SHA512

986eb6de87371c37803a68c572a37d6d6618abe6f1193c5bd7761a4d345f0660ed9aca5aa1ec2540729c522d513d8931ef338bac7f880f0dac6e0683ed761e7d
SSDEEP

12288:Pnp7MTrnNc4cMCEASQPCnXYjCsCutCfAIh+ww3dM:vpITTNcmkS0CnIjoNhatM

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  18b191412c0499399256febff5efb224e9c6462fb4a2db13f42265fadbb8f8c3
- Size
  
  597KB
- MD5
  
  b03a199a7a84f394aea26e212a5ecae1
- SHA1
  
  7e4ce30e88839063c99343009bcd210dd61db568
- SHA256
  
  18b191412c0499399256febff5efb224e9c6462fb4a2db13f42265fadbb8f8c3
- SHA512
  
  986eb6de87371c37803a68c572a37d6d6618abe6f1193c5bd7761a4d345f0660ed9aca5aa1ec2540729c522d513d8931ef338bac7f880f0dac6e0683ed761e7d
- SSDEEP
  
  12288:Pnp7MTrnNc4cMCEASQPCnXYjCsCutCfAIh+ww3dM:vpITTNcmkS0CnIjoNhatM
Score

7^/10

discovery
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2