26b875104dfbee5dad956863a130b8c38c95bce0ca46d7effbf9582301c4ce4d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

iediagcmd.exe
Size

528KB
Sample

231007-drbffsbc32
MD5

a995d5b6490e46a4b5ddbca8d9cf5371
SHA1

87c963fe13bc1ff1a6d961ebf4aae9bd6f0730a2
SHA256

26b875104dfbee5dad956863a130b8c38c95bce0ca46d7effbf9582301c4ce4d
SHA512

53e92089c0e13ce9ce22d6cca925542e52114525a9f6b7c8fcd7a8922b36ee6599a37caab46bbd84c4ee58fb52c4ab81bd64a646623b4d2130dd493622754f06
SSDEEP

6144:akZIE1d78DBtKJcfh2mq1Zi2H/vAwP5gZpOZ1INeWe9Rlvm/JTIbVHKJcfh2m213:ak7ADBtpq1Zi2HZKOXIwgTCp21ZZ

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  iediagcmd.exe
- Size
  
  528KB
- MD5
  
  a995d5b6490e46a4b5ddbca8d9cf5371
- SHA1
  
  87c963fe13bc1ff1a6d961ebf4aae9bd6f0730a2
- SHA256
  
  26b875104dfbee5dad956863a130b8c38c95bce0ca46d7effbf9582301c4ce4d
- SHA512
  
  53e92089c0e13ce9ce22d6cca925542e52114525a9f6b7c8fcd7a8922b36ee6599a37caab46bbd84c4ee58fb52c4ab81bd64a646623b4d2130dd493622754f06
- SSDEEP
  
  6144:akZIE1d78DBtKJcfh2mq1Zi2H/vAwP5gZpOZ1INeWe9Rlvm/JTIbVHKJcfh2m213:ak7ADBtpq1Zi2HZKOXIwgTCp21ZZ
Score

8^/10

evasion persistence
- Modifies Windows Firewall
  evasion
- Registers COM server for autorun
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistence