81cbf233e7cd343baf8f2c6e2e680a00e4bb735618c27e7cc543a5968abe1a68 | Triage

Sharing

General

Target

81cbf233e7cd343baf8f2c6e2e680a00e4bb735618c27e7cc543a5968abe1a68
Size

168KB
Sample

221128-a5xztsga4z
MD5

f17a3789fe6fa4ac2e7502dfa42a91c2
SHA1

53d86ffc2bb5da07127060da5eb13f5cb10b6260
SHA256

81cbf233e7cd343baf8f2c6e2e680a00e4bb735618c27e7cc543a5968abe1a68
SHA512

6e5b25879179301876fb7285c4812735ef1bbe0f53d7a93bdb5309252f7c1697f66d4ef9432ede29669f07835569360df09fdaec27defba14c924d8bb73ab5b2
SSDEEP

3072:nk0M4eOOYQVdD02rbqD5ppAB/zfvfd0tV4b5zeJBNH785PnwJUVBc:nGYQPxb+5pmHfd6V4FyHNfJL

Score

6^/10

persistence

Malware Config

Targets

- Target
  
  81cbf233e7cd343baf8f2c6e2e680a00e4bb735618c27e7cc543a5968abe1a68
- Size
  
  168KB
- MD5
  
  f17a3789fe6fa4ac2e7502dfa42a91c2
- SHA1
  
  53d86ffc2bb5da07127060da5eb13f5cb10b6260
- SHA256
  
  81cbf233e7cd343baf8f2c6e2e680a00e4bb735618c27e7cc543a5968abe1a68
- SHA512
  
  6e5b25879179301876fb7285c4812735ef1bbe0f53d7a93bdb5309252f7c1697f66d4ef9432ede29669f07835569360df09fdaec27defba14c924d8bb73ab5b2
- SSDEEP
  
  3072:nk0M4eOOYQVdD02rbqD5ppAB/zfvfd0tV4b5zeJBNH785PnwJUVBc:nGYQPxb+5pmHfd6V4FyHNfJL
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2