9f2b75fef3e3e52361fce13898caf33fc8b8c8df0c3454db4ad1c979f21a1c68 | Triage

Sharing

General

Target

9f2b75fef3e3e52361fce13898caf33fc8b8c8df0c3454db4ad1c979f21a1c68
Size

171KB
Sample

221206-rhwa6ahc7s
MD5

93a1c7a4a8798272ee0862c83b476345
SHA1

98875077d2e62c047341532141ac94073249c7e6
SHA256

9f2b75fef3e3e52361fce13898caf33fc8b8c8df0c3454db4ad1c979f21a1c68
SHA512

063c589ddf55beb7c2cf0aded85724679472ac76697300055c460870613bdaf1a7dc850e38fffafb0a4c6a1a0cc6ec3e8aee956a4383d20af89edbafc534a7cb
SSDEEP

3072:ZPVW0iQO6eA3V4ZHHnOMP5uKg10Xto8CckXQpK44AFT8:ZP80iFlOwIjKou2QpK44i8

Score

6^/10

persistence

Malware Config

Targets

- Target
  
  9f2b75fef3e3e52361fce13898caf33fc8b8c8df0c3454db4ad1c979f21a1c68
- Size
  
  171KB
- MD5
  
  93a1c7a4a8798272ee0862c83b476345
- SHA1
  
  98875077d2e62c047341532141ac94073249c7e6
- SHA256
  
  9f2b75fef3e3e52361fce13898caf33fc8b8c8df0c3454db4ad1c979f21a1c68
- SHA512
  
  063c589ddf55beb7c2cf0aded85724679472ac76697300055c460870613bdaf1a7dc850e38fffafb0a4c6a1a0cc6ec3e8aee956a4383d20af89edbafc534a7cb
- SSDEEP
  
  3072:ZPVW0iQO6eA3V4ZHHnOMP5uKg10Xto8CckXQpK44AFT8:ZP80iFlOwIjKou2QpK44i8
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2