195af96830e90368913500d9ad8fd2ee63d108e5938b35c1677bf04cebb5c16c | Triage

Sharing

General

Target

195af96830e90368913500d9ad8fd2ee63d108e5938b35c1677bf04cebb5c16c
Size

140KB
Sample

221205-s59yhagc8x
MD5

421ac7caa0defe063ff80d10cd2643d0
SHA1

6e9b152febff204d92b278ad7aca813ed0bb5756
SHA256

195af96830e90368913500d9ad8fd2ee63d108e5938b35c1677bf04cebb5c16c
SHA512

347746d1394e704a7ea59e0c932152aee491a5535cce91071db552965674b899ce5e5fdf218c5f4aac331bb9d639fc70b614510beebe8f761e4c9c3832372da1
SSDEEP

1536:gkWbhgW5o1oS4l1TfG8Umu3/IdsGmPIxl8F4L0a8fcqJ4rs1EI4kbDSxBX3RSF/o:FW+1oS4l5OeuQdrmwvL8EqA

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  195af96830e90368913500d9ad8fd2ee63d108e5938b35c1677bf04cebb5c16c
- Size
  
  140KB
- MD5
  
  421ac7caa0defe063ff80d10cd2643d0
- SHA1
  
  6e9b152febff204d92b278ad7aca813ed0bb5756
- SHA256
  
  195af96830e90368913500d9ad8fd2ee63d108e5938b35c1677bf04cebb5c16c
- SHA512
  
  347746d1394e704a7ea59e0c932152aee491a5535cce91071db552965674b899ce5e5fdf218c5f4aac331bb9d639fc70b614510beebe8f761e4c9c3832372da1
- SSDEEP
  
  1536:gkWbhgW5o1oS4l1TfG8Umu3/IdsGmPIxl8F4L0a8fcqJ4rs1EI4kbDSxBX3RSF/o:FW+1oS4l5OeuQdrmwvL8EqA
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2