e15a97fae1f969cad8aa7169698d6b1abfb55e2bd20d5c69ab58dca76110d608 | Triage

Sharing

General

Target

35ee2f6b6d71008d976f49c7028e2189
Size

178KB
Sample

231225-xjyqkahab4
MD5

35ee2f6b6d71008d976f49c7028e2189
SHA1

1b523d55a0f1d3d1235a59580e3932ca84208203
SHA256

e15a97fae1f969cad8aa7169698d6b1abfb55e2bd20d5c69ab58dca76110d608
SHA512

5e5b1e6a320406f236914d151901e6d26e632be5aefe88924a6087e15847c83ad195c284dfdb92b028598e5af891dfd9ee6dec7c4d71fbd6a6bb156fe2cd0a60
SSDEEP

3072:hnKloR4GuxDN2jt9S/0JTSnEX9aGlJ9siUu:TeGuxQjrS/Qmq

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  35ee2f6b6d71008d976f49c7028e2189
- Size
  
  178KB
- MD5
  
  35ee2f6b6d71008d976f49c7028e2189
- SHA1
  
  1b523d55a0f1d3d1235a59580e3932ca84208203
- SHA256
  
  e15a97fae1f969cad8aa7169698d6b1abfb55e2bd20d5c69ab58dca76110d608
- SHA512
  
  5e5b1e6a320406f236914d151901e6d26e632be5aefe88924a6087e15847c83ad195c284dfdb92b028598e5af891dfd9ee6dec7c4d71fbd6a6bb156fe2cd0a60
- SSDEEP
  
  3072:hnKloR4GuxDN2jt9S/0JTSnEX9aGlJ9siUu:TeGuxQjrS/Qmq
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2