81871c4bfca25f6867a4e9d9537e5b6145d94db3d96f751b64e10218b3c8272f | Triage

Sharing

General

Target

6d02676a0f97685a05edd42c3e4834f8
Size

15KB
Sample

231226-n8cpysggcp
MD5

6d02676a0f97685a05edd42c3e4834f8
SHA1

3d19c9b99f46d519dddf0fb73bd610c2ab0e3659
SHA256

81871c4bfca25f6867a4e9d9537e5b6145d94db3d96f751b64e10218b3c8272f
SHA512

c6a416cef34edb1c1f2ecaf12b9cde0b5dfd8cff7f34676baa0d8587a5cbbc37b8cfdd410a8b5dadee1fdf275ca4b37e3d84cefec7cd0db52121a7fb6670553d
SSDEEP

192:E5SoysZLdcfCePsZE1ByjSkPi2QwtjQl/AlXBM8dJvIkhffzzsrlufW9LCn:JolZLdaIE1AA2QAjQlolBdWCfHO4q6

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  6d02676a0f97685a05edd42c3e4834f8
- Size
  
  15KB
- MD5
  
  6d02676a0f97685a05edd42c3e4834f8
- SHA1
  
  3d19c9b99f46d519dddf0fb73bd610c2ab0e3659
- SHA256
  
  81871c4bfca25f6867a4e9d9537e5b6145d94db3d96f751b64e10218b3c8272f
- SHA512
  
  c6a416cef34edb1c1f2ecaf12b9cde0b5dfd8cff7f34676baa0d8587a5cbbc37b8cfdd410a8b5dadee1fdf275ca4b37e3d84cefec7cd0db52121a7fb6670553d
- SSDEEP
  
  192:E5SoysZLdcfCePsZE1ByjSkPi2QwtjQl/AlXBM8dJvIkhffzzsrlufW9LCn:JolZLdaIE1AA2QAjQlolBdWCfHO4q6
Score

8^/10

evasion persistence
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistence