4003524ac98bdc5f3896cfeb1257d34ec2c04890fb49baf9509e80ec6616d32d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.373e674365803480a4105b59e48bac50.exe
Size

129KB
Sample

231021-z469jsdh28
MD5

373e674365803480a4105b59e48bac50
SHA1

7adf3b3116429cefc7e7bc948e6244bf959171a2
SHA256

4003524ac98bdc5f3896cfeb1257d34ec2c04890fb49baf9509e80ec6616d32d
SHA512

fd117d510eb4e089252b76a21d645fb9ad230d9876b2e8fdfef7cda4f4093f0e4f71b955470172f73a40c0d1caeaef707dc8145937678286f0ae04e9814135e9
SSDEEP

1536:DxYDoGEdr1/MgsBM5sfKs8yzqIDosNXUFkkTw7G00EgsPgpnfnLs:DxjR/jY0y3DvUQi00EgsPg1fn

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  NEAS.373e674365803480a4105b59e48bac50.exe
- Size
  
  129KB
- MD5
  
  373e674365803480a4105b59e48bac50
- SHA1
  
  7adf3b3116429cefc7e7bc948e6244bf959171a2
- SHA256
  
  4003524ac98bdc5f3896cfeb1257d34ec2c04890fb49baf9509e80ec6616d32d
- SHA512
  
  fd117d510eb4e089252b76a21d645fb9ad230d9876b2e8fdfef7cda4f4093f0e4f71b955470172f73a40c0d1caeaef707dc8145937678286f0ae04e9814135e9
- SSDEEP
  
  1536:DxYDoGEdr1/MgsBM5sfKs8yzqIDosNXUFkkTw7G00EgsPgpnfnLs:DxjR/jY0y3DvUQi00EgsPg1fn
Score

8^/10

evasion persistence
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence