90949e8c042b2cc5f13ad3996345abf48b33c8d7ab85a28a6b8638b55e8334e5 | Triage

Sharing

General

Target

90949e8c042b2cc5f13ad3996345abf48b33c8d7ab85a28a6b8638b55e8334e5
Size

976KB
Sample

221204-l4jllahd37
MD5

14f9f99407bb72de111d4121f4f322e5
SHA1

e34868b69768e703063b69cfae91fd2ed905af68
SHA256

90949e8c042b2cc5f13ad3996345abf48b33c8d7ab85a28a6b8638b55e8334e5
SHA512

449f3f7b7e87aae6a5752706d479d2112dc10f089fd1c571eadc7e7ef45c0627e3dc8be2f1c33374e4b2bece1710c58f1975e0121a23baebed2ca66bd0ee76f8
SSDEEP

12288:ZUWIFBUWaVESb4dp4ueUTruF4WTS93nwiT0+tQXN+hzpth21e93v2W8DM:ZUTEES0dVHTr7W+93ww0+ei21o3v2t

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  90949e8c042b2cc5f13ad3996345abf48b33c8d7ab85a28a6b8638b55e8334e5
- Size
  
  976KB
- MD5
  
  14f9f99407bb72de111d4121f4f322e5
- SHA1
  
  e34868b69768e703063b69cfae91fd2ed905af68
- SHA256
  
  90949e8c042b2cc5f13ad3996345abf48b33c8d7ab85a28a6b8638b55e8334e5
- SHA512
  
  449f3f7b7e87aae6a5752706d479d2112dc10f089fd1c571eadc7e7ef45c0627e3dc8be2f1c33374e4b2bece1710c58f1975e0121a23baebed2ca66bd0ee76f8
- SSDEEP
  
  12288:ZUWIFBUWaVESb4dp4ueUTruF4WTS93nwiT0+tQXN+hzpth21e93v2W8DM:ZUTEES0dVHTr7W+93ww0+ei21o3v2t
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2