f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd | Triage

Sharing

General

Target

WinRAR.exe
Size

2.3MB
Sample

230829-zdndraff49
MD5

0b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA1

23e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256

f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512

e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
SSDEEP

49152:+Kgfe5aITdK0UFYQrGoGj/uV6hDnwqbvf8WlJzNwui0hBdH30+:V5aRc3FXbquTBpk+

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  WinRAR.exe
- Size
  
  2.3MB
- MD5
  
  0b114fc0f4b6d49f57b3b01dd9ea6a8c
- SHA1
  
  23e1480c3ff3a54e712d759e9325d362bf52fabd
- SHA256
  
  f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
- SHA512
  
  e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
- SSDEEP
  
  49152:+Kgfe5aITdK0UFYQrGoGj/uV6hDnwqbvf8WlJzNwui0hBdH30+:V5aRc3FXbquTBpk+
Score

10^/10

evasion persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Downloads MZ/PE file
- Stops running service(s)
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Change Default File Association

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Change Default File Association

Scheduled Task/Job

Defense Evasion

Impair Defenses

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Process Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionpersistence

behavioral2