4f8584a88efd1caeaf6660d70c577f1b7b1411581207b2820684dbabed9a7052 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06d6d9832b39b7f2d45697d13cc16826
Size

424KB
Sample

231229-3ds6sahbd4
MD5

06d6d9832b39b7f2d45697d13cc16826
SHA1

ce3ff30ae712265cce6b20c39711de1fb51adbf5
SHA256

4f8584a88efd1caeaf6660d70c577f1b7b1411581207b2820684dbabed9a7052
SHA512

8f4bd4f491bce8f8972879ec76595c9b7cd840e224fc5ac89b2111f18150cd54432ac5a7fa995ae210c66bca291ecdf892d30aa28f88dad42e4683595529a831
SSDEEP

6144:lRWPdP/u9zflQeYtAwGGzawN2zkzfGTn8gSmuW+Av9CtWaJbiiUIZoV:qof2WwbzawN7zfGTDHH+c9CXkDI

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  06d6d9832b39b7f2d45697d13cc16826
- Size
  
  424KB
- MD5
  
  06d6d9832b39b7f2d45697d13cc16826
- SHA1
  
  ce3ff30ae712265cce6b20c39711de1fb51adbf5
- SHA256
  
  4f8584a88efd1caeaf6660d70c577f1b7b1411581207b2820684dbabed9a7052
- SHA512
  
  8f4bd4f491bce8f8972879ec76595c9b7cd840e224fc5ac89b2111f18150cd54432ac5a7fa995ae210c66bca291ecdf892d30aa28f88dad42e4683595529a831
- SSDEEP
  
  6144:lRWPdP/u9zflQeYtAwGGzawN2zkzfGTn8gSmuW+Av9CtWaJbiiUIZoV:qof2WwbzawN7zfGTDHH+c9CXkDI
Score

8^/10

evasion persistence
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2