572ee3833204960e1eb9bd8c3aabdc11be25603a201dcd5fb64ac08e125b60e2 | Triage

Sharing

General

Target

572ee3833204960e1eb9bd8c3aabdc11be25603a201dcd5fb64ac08e125b60e2
Size

96KB
Sample

221201-ez314shb6x
MD5

41647fbe31958c542c865c426e926620
SHA1

4abb509514ee798a18dbc438c2b18e59ac8112c5
SHA256

572ee3833204960e1eb9bd8c3aabdc11be25603a201dcd5fb64ac08e125b60e2
SHA512

e3be343d41888945aaf20bcffea83864b2c1915d62222ff98e1df65e5151e102588b27bae67b373dd612b2c5a8e754975c5f113520a65d02024c61a6b307a722
SSDEEP

1536:2grUzmCJ3J4+PUcgzwVTsTNmVYc+kmMyRoV0fThs6wniUydnHqW:TUzmCJ5EcTc+T+VvfVs6wnSB1

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  572ee3833204960e1eb9bd8c3aabdc11be25603a201dcd5fb64ac08e125b60e2
- Size
  
  96KB
- MD5
  
  41647fbe31958c542c865c426e926620
- SHA1
  
  4abb509514ee798a18dbc438c2b18e59ac8112c5
- SHA256
  
  572ee3833204960e1eb9bd8c3aabdc11be25603a201dcd5fb64ac08e125b60e2
- SHA512
  
  e3be343d41888945aaf20bcffea83864b2c1915d62222ff98e1df65e5151e102588b27bae67b373dd612b2c5a8e754975c5f113520a65d02024c61a6b307a722
- SSDEEP
  
  1536:2grUzmCJ3J4+PUcgzwVTsTNmVYc+kmMyRoV0fThs6wniUydnHqW:TUzmCJ5EcTc+T+VvfVs6wnSB1
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2