Overview

overview

8

Static

static

3

79642aa8ae...33.exe

windows7-x64

8

79642aa8ae...33.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79642aa8ae971b5e655cc5e4b989c133

  • Size

    22KB

  • Sample

    240127-f5v35aebc9

  • MD5

    79642aa8ae971b5e655cc5e4b989c133

  • SHA1

    ee12fc5dfdf42658d713c11d095627e4f1b4670e

  • SHA256

    b81f4f21017f38ee51e25e23a4357dae649554e43bd55f9a4840262af7f51144

  • SHA512

    cc32ed46904073c75c3469e6ed7f9e9a80e1bc88a52a5fb1ce2093f807bfa6c71432e842c4c9fe4025312618177083996690ce6cfbcea756236ea4bda597d3c4

  • SSDEEP

    384:cGIm/vdaWQ5UJ3vU8AZcWh36/2PA3fYQoy07uSFj2X/P57x:cGjQ5m3cz30OAvYQonuSJq3t

Score
8/10
persistence

Malware Config

Targets

    • Target

      79642aa8ae971b5e655cc5e4b989c133

    • Size

      22KB

    • MD5

      79642aa8ae971b5e655cc5e4b989c133

    • SHA1

      ee12fc5dfdf42658d713c11d095627e4f1b4670e

    • SHA256

      b81f4f21017f38ee51e25e23a4357dae649554e43bd55f9a4840262af7f51144

    • SHA512

      cc32ed46904073c75c3469e6ed7f9e9a80e1bc88a52a5fb1ce2093f807bfa6c71432e842c4c9fe4025312618177083996690ce6cfbcea756236ea4bda597d3c4

    • SSDEEP

      384:cGIm/vdaWQ5UJ3vU8AZcWh36/2PA3fYQoy07uSFj2X/P57x:cGjQ5m3cz30OAvYQonuSJq3t

    Score
    8/10
    persistence

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks