94ccbafb8cebaffb3a3e79c31e0b16dcef16f9caae6dad02b093ee84fc16f49b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d664295e0760cfc993320b34a1c9a0e7
Size

560KB
Sample

230724-ea7m1aac9v
MD5

d664295e0760cfc993320b34a1c9a0e7
SHA1

14a57de65343990a557963c4ed69fd1243c729f5
SHA256

94ccbafb8cebaffb3a3e79c31e0b16dcef16f9caae6dad02b093ee84fc16f49b
SHA512

52a4ad444978ff902da3ae4391bb37c3715aeb67e2bb7fa4fb16fdde7f62af3344211d00ccbde8bdbb05a012579c5a476d0ba74a008572fd49efdb09b2cc1504
SSDEEP

12288:1PVV/jr///zyXGyBcw/aNPRWPXA1mrahYJfuy:tjD3zyXJBceOJW0mrhf

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  d664295e0760cfc993320b34a1c9a0e7
- Size
  
  560KB
- MD5
  
  d664295e0760cfc993320b34a1c9a0e7
- SHA1
  
  14a57de65343990a557963c4ed69fd1243c729f5
- SHA256
  
  94ccbafb8cebaffb3a3e79c31e0b16dcef16f9caae6dad02b093ee84fc16f49b
- SHA512
  
  52a4ad444978ff902da3ae4391bb37c3715aeb67e2bb7fa4fb16fdde7f62af3344211d00ccbde8bdbb05a012579c5a476d0ba74a008572fd49efdb09b2cc1504
- SSDEEP
  
  12288:1PVV/jr///zyXGyBcw/aNPRWPXA1mrahYJfuy:tjD3zyXJBceOJW0mrhf
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Modifies Installed Components in the registry
  persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence