a0e02459952966c6778a837f857002b38f02361bf2b46049b3bc655ed953017e | Triage

Sharing

General

Target

a0e02459952966c6778a837f857002b38f02361bf2b46049b3bc655ed953017e
Size

37KB
Sample

221205-vqg1aahg56
MD5

4c5c9c0eecc5485920c42529c1772b0e
SHA1

5630a6dc668c840b6cef7321a0ff4d9732153736
SHA256

a0e02459952966c6778a837f857002b38f02361bf2b46049b3bc655ed953017e
SHA512

cd3292f8097275abc3475db9f7d6a2154e55866d85664ab2c922705840f77b06339d16e318186f40e6bf3e6fb0bdfc097aadf58583e41495c2f9e6be967319e2
SSDEEP

768:XQFTDurYyURDrAzfGdIYRt2LuX7oHm93SN/+kfKZ8ka:XQFTvVzt2LuOsIG2KZ8ka

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  a0e02459952966c6778a837f857002b38f02361bf2b46049b3bc655ed953017e
- Size
  
  37KB
- MD5
  
  4c5c9c0eecc5485920c42529c1772b0e
- SHA1
  
  5630a6dc668c840b6cef7321a0ff4d9732153736
- SHA256
  
  a0e02459952966c6778a837f857002b38f02361bf2b46049b3bc655ed953017e
- SHA512
  
  cd3292f8097275abc3475db9f7d6a2154e55866d85664ab2c922705840f77b06339d16e318186f40e6bf3e6fb0bdfc097aadf58583e41495c2f9e6be967319e2
- SSDEEP
  
  768:XQFTDurYyURDrAzfGdIYRt2LuX7oHm93SN/+kfKZ8ka:XQFTvVzt2LuOsIG2KZ8ka
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Deletes itself
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2