81831e95c268aa5f19f71bb63814b7f5f2ab8d574d73445493fa672480cda73a | Triage

Sharing

General

Target

469c894ae9f8265bb67c747d7031583c.exe
Size

96KB
Sample

240103-spxy1affaq
MD5

469c894ae9f8265bb67c747d7031583c
SHA1

581bf8a22c186492168a74f18bbf3dd0256f99de
SHA256

81831e95c268aa5f19f71bb63814b7f5f2ab8d574d73445493fa672480cda73a
SHA512

6adaeab42ef5d14e44060c00ef15f6f8f5734faa89c9677143e06c44ed5419710a049f986821d87b64c00a4f423760e119b3c2336ddffb4b55b9250cc95a32c3
SSDEEP

1536:pw2CSU+mhjmxXf7bJP/EARUEWGt6rgVpuUVRlcmQPkUB:yjVhcXf75/FRUHGt5mUV/uh

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  469c894ae9f8265bb67c747d7031583c.exe
- Size
  
  96KB
- MD5
  
  469c894ae9f8265bb67c747d7031583c
- SHA1
  
  581bf8a22c186492168a74f18bbf3dd0256f99de
- SHA256
  
  81831e95c268aa5f19f71bb63814b7f5f2ab8d574d73445493fa672480cda73a
- SHA512
  
  6adaeab42ef5d14e44060c00ef15f6f8f5734faa89c9677143e06c44ed5419710a049f986821d87b64c00a4f423760e119b3c2336ddffb4b55b9250cc95a32c3
- SSDEEP
  
  1536:pw2CSU+mhjmxXf7bJP/EARUEWGt6rgVpuUVRlcmQPkUB:yjVhcXf75/FRUHGt5mUV/uh
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2