37d72193214b00659bded1a8feca2c7d458466c65cccc62a6aacc7a1052cbd63 | Triage

Sharing

General

Target

bc0373870c85be54fdd7c7c35ec026ff
Size

116KB
Sample

240309-rkvgmshf34
MD5

bc0373870c85be54fdd7c7c35ec026ff
SHA1

ccdaf9d27c7163d885ea7d93b453120fc70e4dae
SHA256

37d72193214b00659bded1a8feca2c7d458466c65cccc62a6aacc7a1052cbd63
SHA512

162701363c3e795160936448bb8a0e87f0349396ab213b243ab85549e54e0a2f8df877b474ee885d36c0007357be1a36096518a7465a41f38180c773e4d91000
SSDEEP

1536:bfsG+8DE180o1YfkDklKKR1D5OqnVgufxwqbU4EETLSmNlshbjQviSjwUbT2o8N:bvB70EYH7D5OGVnOqbnEfmNGCJdahN

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  bc0373870c85be54fdd7c7c35ec026ff
- Size
  
  116KB
- MD5
  
  bc0373870c85be54fdd7c7c35ec026ff
- SHA1
  
  ccdaf9d27c7163d885ea7d93b453120fc70e4dae
- SHA256
  
  37d72193214b00659bded1a8feca2c7d458466c65cccc62a6aacc7a1052cbd63
- SHA512
  
  162701363c3e795160936448bb8a0e87f0349396ab213b243ab85549e54e0a2f8df877b474ee885d36c0007357be1a36096518a7465a41f38180c773e4d91000
- SSDEEP
  
  1536:bfsG+8DE180o1YfkDklKKR1D5OqnVgufxwqbU4EETLSmNlshbjQviSjwUbT2o8N:bvB70EYH7D5OGVnOqbnEfmNGCJdahN
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2