e4dfb423b685426009b60db5a1ac8a51cf8deb6f0636b849382ef884f2f297ed | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1cc9bbd71050270f17c1c2dbece2cee0
Size

68KB
Sample

231230-z6zbqadcd7
MD5

1cc9bbd71050270f17c1c2dbece2cee0
SHA1

24d654fe36b9aec5ef08c2bfa832b42aa1256f26
SHA256

e4dfb423b685426009b60db5a1ac8a51cf8deb6f0636b849382ef884f2f297ed
SHA512

75bbf222da1b451a2f4b04f9265e6437bed0c3590468fe339d11ed90fc555f0f4d42a1446104368d6218b62c482b9a43b54c18a2fa707a1538158cf0772eece5
SSDEEP

1536:JoX+wOSQ1iQAzymZrqIG13q2QMPMdYct4l:J8+JmhA3qZdYcOl

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  1cc9bbd71050270f17c1c2dbece2cee0
- Size
  
  68KB
- MD5
  
  1cc9bbd71050270f17c1c2dbece2cee0
- SHA1
  
  24d654fe36b9aec5ef08c2bfa832b42aa1256f26
- SHA256
  
  e4dfb423b685426009b60db5a1ac8a51cf8deb6f0636b849382ef884f2f297ed
- SHA512
  
  75bbf222da1b451a2f4b04f9265e6437bed0c3590468fe339d11ed90fc555f0f4d42a1446104368d6218b62c482b9a43b54c18a2fa707a1538158cf0772eece5
- SSDEEP
  
  1536:JoX+wOSQ1iQAzymZrqIG13q2QMPMdYct4l:J8+JmhA3qZdYcOl
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence