dfaf36beb50196504e945133b64b0d294af35bcced5856f4dfb367ca1e36b4a1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

584a85238b3041b073f981deb95ffcc0
Size

440KB
Sample

240113-hw3sqaega6
MD5

584a85238b3041b073f981deb95ffcc0
SHA1

b022538715c332be6cfa44d7ea37809c70dd3c40
SHA256

dfaf36beb50196504e945133b64b0d294af35bcced5856f4dfb367ca1e36b4a1
SHA512

61595b5d1d88a5390d804587c99dcefd53dd07fad3bad025d09dacd33a2030fdd8ddff9461f94939791aff1c55c3380002dcb113bba3f449ef07a1bf9348dd6e
SSDEEP

6144:QW4w9FbaBFFpjBhJlCHydIlavBWpcyMDaaDgx+roTuRiMv14j9d6+NO2IZETEeNo:N9QFBwHydIGy5ogwr1iMv14RdvOPuTL

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  584a85238b3041b073f981deb95ffcc0
- Size
  
  440KB
- MD5
  
  584a85238b3041b073f981deb95ffcc0
- SHA1
  
  b022538715c332be6cfa44d7ea37809c70dd3c40
- SHA256
  
  dfaf36beb50196504e945133b64b0d294af35bcced5856f4dfb367ca1e36b4a1
- SHA512
  
  61595b5d1d88a5390d804587c99dcefd53dd07fad3bad025d09dacd33a2030fdd8ddff9461f94939791aff1c55c3380002dcb113bba3f449ef07a1bf9348dd6e
- SSDEEP
  
  6144:QW4w9FbaBFFpjBhJlCHydIlavBWpcyMDaaDgx+roTuRiMv14j9d6+NO2IZETEeNo:N9QFBwHydIGy5ogwr1iMv14RdvOPuTL
Score

8^/10

evasion persistence
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2