56f0dc8c7d96c286954ed45010bbf5a2216f28fd03c77d67d6f475fea5f94d54 | Triage

Sharing

General

Target

727ec2169730ff49bc0b73927a9ed4b8
Size

250KB
Sample

240124-rzbyvacgbn
MD5

727ec2169730ff49bc0b73927a9ed4b8
SHA1

eefb697370bed23ace6fe93b78de57c03e1791e6
SHA256

56f0dc8c7d96c286954ed45010bbf5a2216f28fd03c77d67d6f475fea5f94d54
SHA512

2e7cfb50eb36c93643786653431081388bc05a1b23ff85753f96cee96c06029f533d23621abdb2cb42177e14ac5fd3f8417d5e66cbf31d9121bbf067e44b6c5f
SSDEEP

3072:uGOFLomQsQtM25LSF12LT8nsQqIbSC3IzSNGOsDGLCpIfMhlGV6T3A/tROoHniXb:0XxQtJ2FSBYr3gOrEhdT3A/tROoHLQ

Score

10^/10

persistence upx

Malware Config

Targets

- Target
  
  727ec2169730ff49bc0b73927a9ed4b8
- Size
  
  250KB
- MD5
  
  727ec2169730ff49bc0b73927a9ed4b8
- SHA1
  
  eefb697370bed23ace6fe93b78de57c03e1791e6
- SHA256
  
  56f0dc8c7d96c286954ed45010bbf5a2216f28fd03c77d67d6f475fea5f94d54
- SHA512
  
  2e7cfb50eb36c93643786653431081388bc05a1b23ff85753f96cee96c06029f533d23621abdb2cb42177e14ac5fd3f8417d5e66cbf31d9121bbf067e44b6c5f
- SSDEEP
  
  3072:uGOFLomQsQtM25LSF12LT8nsQqIbSC3IzSNGOsDGLCpIfMhlGV6T3A/tROoHniXb:0XxQtJ2FSBYr3gOrEhdT3A/tROoHLQ
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2