32bece6ac967d9dfd0a751a3f26c8d6b7835ab04ecf616572672b6655ea4ef6d | Triage

Sharing

General

Target

6af6df87498c6e8df0ce8e94375f469a
Size

369KB
Sample

231226-nm23qaddar
MD5

6af6df87498c6e8df0ce8e94375f469a
SHA1

787084f19d3bb19249f9b9e9c7bb5d26f7f63b5a
SHA256

32bece6ac967d9dfd0a751a3f26c8d6b7835ab04ecf616572672b6655ea4ef6d
SHA512

c9809a1f1ced2909a6f8ad903ce237e0144a3740447f5e027ed2263055511aca1648ac65360dfd23e676ebad9fe135328080dcad4111cd177aa7fc6ea2099bc0
SSDEEP

6144:9i+L6CxGUgwjK8wVg16e3N29TYPsQZogU85b8ZprH+qMPQuPkdoPMFs4nyYUt1t:A+eDz8w8g3QZogT5IZRHUPZM4MS4xUXt

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  6af6df87498c6e8df0ce8e94375f469a
- Size
  
  369KB
- MD5
  
  6af6df87498c6e8df0ce8e94375f469a
- SHA1
  
  787084f19d3bb19249f9b9e9c7bb5d26f7f63b5a
- SHA256
  
  32bece6ac967d9dfd0a751a3f26c8d6b7835ab04ecf616572672b6655ea4ef6d
- SHA512
  
  c9809a1f1ced2909a6f8ad903ce237e0144a3740447f5e027ed2263055511aca1648ac65360dfd23e676ebad9fe135328080dcad4111cd177aa7fc6ea2099bc0
- SSDEEP
  
  6144:9i+L6CxGUgwjK8wVg16e3N29TYPsQZogU85b8ZprH+qMPQuPkdoPMFs4nyYUt1t:A+eDz8w8g3QZogT5IZRHUPZM4MS4xUXt
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Modifies Installed Components in the registry
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence