bee512e863629c0173a903f4effa7afd488efe329a6595f1369d7ce1bfda8d23 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

03f617a0b40207b2375e872604eeb31f
Size

140KB
Sample

231229-zwkqksadfp
MD5

03f617a0b40207b2375e872604eeb31f
SHA1

0e0f4c2d0adffa4446e41980a7f6429a5d439a5b
SHA256

bee512e863629c0173a903f4effa7afd488efe329a6595f1369d7ce1bfda8d23
SHA512

f0f49604712ec3b5f609436830abfd96cb0305da91a8f3518f60a52f355e8fc77e2b210505093f982e90547c34d1faf4b22d9ce3378cab83cad0cbc49b6613ed
SSDEEP

3072:+WILKOfupG2tGQO1pwVD06BK+LuiF4ByGsNd:EmOfugfQ6pO06Q+LuiF4Ev

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  03f617a0b40207b2375e872604eeb31f
- Size
  
  140KB
- MD5
  
  03f617a0b40207b2375e872604eeb31f
- SHA1
  
  0e0f4c2d0adffa4446e41980a7f6429a5d439a5b
- SHA256
  
  bee512e863629c0173a903f4effa7afd488efe329a6595f1369d7ce1bfda8d23
- SHA512
  
  f0f49604712ec3b5f609436830abfd96cb0305da91a8f3518f60a52f355e8fc77e2b210505093f982e90547c34d1faf4b22d9ce3378cab83cad0cbc49b6613ed
- SSDEEP
  
  3072:+WILKOfupG2tGQO1pwVD06BK+LuiF4ByGsNd:EmOfugfQ6pO06Q+LuiF4Ev
Score

8^/10

evasion persistence
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2