7861a560e6dab703d8ec5d6e17bcc39741a5d7a0b09cd0942feb7d309a026d57 | Triage

Sharing

General

Target

f6c40d26fa7109ee44e50fdf91ea83a7
Size

72KB
Sample

231228-zg5r7scecn
MD5

f6c40d26fa7109ee44e50fdf91ea83a7
SHA1

db7387e4451e8ec785053467ddf6fd2c82217136
SHA256

7861a560e6dab703d8ec5d6e17bcc39741a5d7a0b09cd0942feb7d309a026d57
SHA512

3929b537484f7115540f16645e18bdc7c01ecbedc4d48784fdd481b2947a6ca893cab39aedcf5557c678b894646607f7be133b412d4a422f2e1d7ca24858e3b7
SSDEEP

1536:LSWJ77t48O9kf5KO2UftQKwS6Wc0P88t7uHwcJyaD3sbNhxjCM5m:LRqtkfMj6uKwAtPluHpLsPxj

Score

6^/10

persistence

Malware Config

Targets

- Target
  
  f6c40d26fa7109ee44e50fdf91ea83a7
- Size
  
  72KB
- MD5
  
  f6c40d26fa7109ee44e50fdf91ea83a7
- SHA1
  
  db7387e4451e8ec785053467ddf6fd2c82217136
- SHA256
  
  7861a560e6dab703d8ec5d6e17bcc39741a5d7a0b09cd0942feb7d309a026d57
- SHA512
  
  3929b537484f7115540f16645e18bdc7c01ecbedc4d48784fdd481b2947a6ca893cab39aedcf5557c678b894646607f7be133b412d4a422f2e1d7ca24858e3b7
- SSDEEP
  
  1536:LSWJ77t48O9kf5KO2UftQKwS6Wc0P88t7uHwcJyaD3sbNhxjCM5m:LRqtkfMj6uKwAtPluHpLsPxj
Score

6^/10

persistence
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2