331dfdf31cd1f922b8d15b20dd53e36101dd664db71ea79d290e91d6f8fe98b8 | Triage

Sharing

General

Target

331dfdf31cd1f922b8d15b20dd53e36101dd664db71ea79d290e91d6f8fe98b8
Size

809KB
Sample

221205-x5mv7ahb72
MD5

4de339ceceaaecbaa3d7d9ee12774ec0
SHA1

d9b8919c0868b7e34cbd7853486482cd805e4912
SHA256

331dfdf31cd1f922b8d15b20dd53e36101dd664db71ea79d290e91d6f8fe98b8
SHA512

3f1339abea21f027380e9ae8671529e63472487b7f5cc376a5e6cbc027d5302e1637f2075871d7335163d6c02d2e4333ccb1f811aa9d54122dccdd009da1ff64
SSDEEP

12288:0H7Wcjdc/r2sxxiPGGAOOPSXDV8ClgVYhX5FSsf8QI6raeH4lviM3Z7b:0bCj2sObHtqQ4QI6lH4lqM3Z7b

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  331dfdf31cd1f922b8d15b20dd53e36101dd664db71ea79d290e91d6f8fe98b8
- Size
  
  809KB
- MD5
  
  4de339ceceaaecbaa3d7d9ee12774ec0
- SHA1
  
  d9b8919c0868b7e34cbd7853486482cd805e4912
- SHA256
  
  331dfdf31cd1f922b8d15b20dd53e36101dd664db71ea79d290e91d6f8fe98b8
- SHA512
  
  3f1339abea21f027380e9ae8671529e63472487b7f5cc376a5e6cbc027d5302e1637f2075871d7335163d6c02d2e4333ccb1f811aa9d54122dccdd009da1ff64
- SSDEEP
  
  12288:0H7Wcjdc/r2sxxiPGGAOOPSXDV8ClgVYhX5FSsf8QI6raeH4lviM3Z7b:0bCj2sObHtqQ4QI6lH4lqM3Z7b
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Deletes itself
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2