dcb337bee0f782bbe55524424516c7b9b56d35e9ced8931870e4ce9467861540 | Triage

Sharing

General

Target

setup_JC.exe
Size

503KB
Sample

230806-szxqzscc6x
MD5

1954869eee7c68693ad83c2c9116d739
SHA1

2cb820b3b0c3581033cca1a0cb49c97d1c3f0eb1
SHA256

dcb337bee0f782bbe55524424516c7b9b56d35e9ced8931870e4ce9467861540
SHA512

d94aa54872825d6093297304c3278b699e050bf8cc0a0a0043fc8b2518bb4c0ea309cd11f35a141ca5df3178dac66ae91a0068094bfb7b6284cdb145ffd0a054
SSDEEP

12288:T8HjWTxA6M8erwyFeGA8HjWTxA6M8erwyFeGb:gK1D9Y7K1D9Yb

Score

8^/10

evasion

Malware Config

Targets

- Target
  
  setup_JC.exe
- Size
  
  503KB
- MD5
  
  1954869eee7c68693ad83c2c9116d739
- SHA1
  
  2cb820b3b0c3581033cca1a0cb49c97d1c3f0eb1
- SHA256
  
  dcb337bee0f782bbe55524424516c7b9b56d35e9ced8931870e4ce9467861540
- SHA512
  
  d94aa54872825d6093297304c3278b699e050bf8cc0a0a0043fc8b2518bb4c0ea309cd11f35a141ca5df3178dac66ae91a0068094bfb7b6284cdb145ffd0a054
- SSDEEP
  
  12288:T8HjWTxA6M8erwyFeGA8HjWTxA6M8erwyFeGb:gK1D9Y7K1D9Yb
Score

8^/10

evasion
- Blocklisted process makes network request
- Modifies Windows Firewall
  evasion
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2