04d85914871db991187661b756e878c545e71e41705fe4c027f85a5bf6e58c9b | Triage

Sharing

General

Target

351fc04c0361cfb9608263ce035063f1
Size

490KB
Sample

231225-xavbsafdh8
MD5

351fc04c0361cfb9608263ce035063f1
SHA1

73422958618c9d984ed4ef4c2ba8a60a4ea63436
SHA256

04d85914871db991187661b756e878c545e71e41705fe4c027f85a5bf6e58c9b
SHA512

433c00ff7fe9b83084d5562661b0955378d930713e1a35112197e61ddae4db1fcf755f6082bcaa2a562faf7b4670da17c32dabab342888bec0a191277918934e
SSDEEP

6144:inJdiMUWMkEXe5npiM1VzRMwiKwZGg5IAHtdGlIS+Ln8mAzUoFr:sdiMUWMkEep91VVMvKI95IQ0lm78mAZ

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  351fc04c0361cfb9608263ce035063f1
- Size
  
  490KB
- MD5
  
  351fc04c0361cfb9608263ce035063f1
- SHA1
  
  73422958618c9d984ed4ef4c2ba8a60a4ea63436
- SHA256
  
  04d85914871db991187661b756e878c545e71e41705fe4c027f85a5bf6e58c9b
- SHA512
  
  433c00ff7fe9b83084d5562661b0955378d930713e1a35112197e61ddae4db1fcf755f6082bcaa2a562faf7b4670da17c32dabab342888bec0a191277918934e
- SSDEEP
  
  6144:inJdiMUWMkEXe5npiM1VzRMwiKwZGg5IAHtdGlIS+Ln8mAzUoFr:sdiMUWMkEep91VVMvKI95IQ0lm78mAZ
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence