ae1dab47fae0307831ec90b249d26ab4d783fd1fbfebf98a2448d40932885bbd | Triage

Resubmissions

31/08/2023, 12:31

230831-pp5gasef7w 9

31/08/2023, 12:09

230831-pbznwsfa54 10

Sharing

General

Target

malware200.exe
Size

448KB
Sample

230831-pp5gasef7w
MD5

957302c7e0c9e025397c2e3cfdc0fef3
SHA1

10ac72a20ac5cd28c94199899fe2eae6ed5b3a84
SHA256

ae1dab47fae0307831ec90b249d26ab4d783fd1fbfebf98a2448d40932885bbd
SHA512

e1443c86e1acb84c5ecb80db5ecca931882478bfdc792c99875eef93b028ba169433dfa2fea8c7a6ee78a3792108172fb8d2e41103a76c77f8d67ee967948ebc
SSDEEP

12288:oquErHF6xC9D6DmR1J98w4oknqOOCyQf1vYOUlsxd:prl6kD68JmlotQfhHUl4

Score

9^/10

evasion persistence

Malware Config

Targets

- Target
  
  malware200.exe
- Size
  
  448KB
- MD5
  
  957302c7e0c9e025397c2e3cfdc0fef3
- SHA1
  
  10ac72a20ac5cd28c94199899fe2eae6ed5b3a84
- SHA256
  
  ae1dab47fae0307831ec90b249d26ab4d783fd1fbfebf98a2448d40932885bbd
- SHA512
  
  e1443c86e1acb84c5ecb80db5ecca931882478bfdc792c99875eef93b028ba169433dfa2fea8c7a6ee78a3792108172fb8d2e41103a76c77f8d67ee967948ebc
- SSDEEP
  
  12288:oquErHF6xC9D6DmR1J98w4oknqOOCyQf1vYOUlsxd:prl6kD68JmlotQfhHUl4
Score

9^/10

evasion persistence
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Modifies WinLogon
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Account Manipulation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence