16dd8e8144501c890b4b3a68983a78e4fe7578097cbdc68d9d7fbbd105e3374f | Triage

Sharing

General

Target

16dd8e8144501c890b4b3a68983a78e4fe7578097cbdc68d9d7fbbd105e3374f
Size

144KB
Sample

221127-t52skacb65
MD5

203f8b6e09c6b46db6362b4987e96895
SHA1

5b8ad7739213eeafafdc72f7ec4d10a5b672686b
SHA256

16dd8e8144501c890b4b3a68983a78e4fe7578097cbdc68d9d7fbbd105e3374f
SHA512

1490ef26050f5ac847c7f0a3fc705b5663f661e7e89187255767ddae748585e460d57e183e823458388da2d93a2a7940c758b79104b5fced2cafb9884c613100
SSDEEP

3072:lAr7XvVgyG22sUHsWvDvTWMlxfFj9WnIfypmm5DygXQqLZQ5X0V92ol:l87XdZG2rUH5v7Xl/j4oypxtOl0Vr

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  16dd8e8144501c890b4b3a68983a78e4fe7578097cbdc68d9d7fbbd105e3374f
- Size
  
  144KB
- MD5
  
  203f8b6e09c6b46db6362b4987e96895
- SHA1
  
  5b8ad7739213eeafafdc72f7ec4d10a5b672686b
- SHA256
  
  16dd8e8144501c890b4b3a68983a78e4fe7578097cbdc68d9d7fbbd105e3374f
- SHA512
  
  1490ef26050f5ac847c7f0a3fc705b5663f661e7e89187255767ddae748585e460d57e183e823458388da2d93a2a7940c758b79104b5fced2cafb9884c613100
- SSDEEP
  
  3072:lAr7XvVgyG22sUHsWvDvTWMlxfFj9WnIfypmm5DygXQqLZQ5X0V92ol:l87XdZG2rUH5v7Xl/j4oypxtOl0Vr
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2