fe4b3993120d4a06c43423d8bdcba075464e035c094bbb922adecb48055263df | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Deluxe_Synchronize.exe
Size

4.5MB
Sample

231117-pyp3zahd46
MD5

b58a9bc9b609042051a647f6544a7b20
SHA1

e6d212dccc03ae4e4657c60aa8e3ea94d83c85e1
SHA256

fe4b3993120d4a06c43423d8bdcba075464e035c094bbb922adecb48055263df
SHA512

95877a7ca098808a58ee8e2f639925eb5bcebcc1c2b517e41512c7c1639bbe2b7bfb7110ecc94c22bb81b18c4c05dd674aea18529343a0a711a77759a872b098
SSDEEP

98304:pxm3SibLcCMPHvHKM0Bo7JAGeI8VEHpjPyFlKXldmDtnz6:pILcrPyYJWqHtyFoldmDpz6

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  Deluxe_Synchronize.exe
- Size
  
  4.5MB
- MD5
  
  b58a9bc9b609042051a647f6544a7b20
- SHA1
  
  e6d212dccc03ae4e4657c60aa8e3ea94d83c85e1
- SHA256
  
  fe4b3993120d4a06c43423d8bdcba075464e035c094bbb922adecb48055263df
- SHA512
  
  95877a7ca098808a58ee8e2f639925eb5bcebcc1c2b517e41512c7c1639bbe2b7bfb7110ecc94c22bb81b18c4c05dd674aea18529343a0a711a77759a872b098
- SSDEEP
  
  98304:pxm3SibLcCMPHvHKM0Bo7JAGeI8VEHpjPyFlKXldmDtnz6:pILcrPyYJWqHtyFoldmDpz6
Score

7^/10

persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2