c89c74a42dc7e8ba62490a3f73f031caec9ec3579bc69d169abc2bfd2e3719d2 | Triage

Sharing

General

Target

tmp
Size

5.4MB
Sample

231012-bcdadsgf77
MD5

ac5a067a49c0347a26cb08dbf77f45b2
SHA1

961323bf26e320183019c6a759373017fa1d1ec2
SHA256

c89c74a42dc7e8ba62490a3f73f031caec9ec3579bc69d169abc2bfd2e3719d2
SHA512

fecabc22397856af602384d99f017ecb2b3624d96ae6fcc95f34b860fcb8b4c94c6e957b120762499ea72de7ca9b0e628252196093ec12f57b176641b8c00d94
SSDEEP

98304:cAWVhcggbXvZnyKbxK0UiIeYjRJFpFx9e+11:cHyLKN/eeRJpHv1

Score

10^/10

evasion

Malware Config

Targets

- Target
  
  tmp
- Size
  
  5.4MB
- MD5
  
  ac5a067a49c0347a26cb08dbf77f45b2
- SHA1
  
  961323bf26e320183019c6a759373017fa1d1ec2
- SHA256
  
  c89c74a42dc7e8ba62490a3f73f031caec9ec3579bc69d169abc2bfd2e3719d2
- SHA512
  
  fecabc22397856af602384d99f017ecb2b3624d96ae6fcc95f34b860fcb8b4c94c6e957b120762499ea72de7ca9b0e628252196093ec12f57b176641b8c00d94
- SSDEEP
  
  98304:cAWVhcggbXvZnyKbxK0UiIeYjRJFpFx9e+11:cHyLKN/eeRJpHv1
Score

10^/10

evasion
- Modifies security service
  evasion
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Stops running service(s)
  evasion
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2