1941cf4f2cc2aba80c51002946dd2c0f75da10b0e169a5d7db67985e6d41c99c | Triage

Sharing

General

Target

c657885b18b244e54f8292933f74018e
Size

432KB
Sample

240313-txm97she7z
MD5

c657885b18b244e54f8292933f74018e
SHA1

0e87b183da4571b9a57fc9d249c7bf9a6f0a1d41
SHA256

1941cf4f2cc2aba80c51002946dd2c0f75da10b0e169a5d7db67985e6d41c99c
SHA512

515b42b12ec93bbdd9c57b155a09e1e40d6dcacb9b466c9e08684dccf65a487eb85940df840af0676299acf9bd547b869be9caff7a61bc5d59486bc658b13aa8
SSDEEP

12288:441TXKOrbNfYJmiyjjM0xdeTOLG9vZ23F:4kTaO3NfSmiyjIsm5xQF

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  c657885b18b244e54f8292933f74018e
- Size
  
  432KB
- MD5
  
  c657885b18b244e54f8292933f74018e
- SHA1
  
  0e87b183da4571b9a57fc9d249c7bf9a6f0a1d41
- SHA256
  
  1941cf4f2cc2aba80c51002946dd2c0f75da10b0e169a5d7db67985e6d41c99c
- SHA512
  
  515b42b12ec93bbdd9c57b155a09e1e40d6dcacb9b466c9e08684dccf65a487eb85940df840af0676299acf9bd547b869be9caff7a61bc5d59486bc658b13aa8
- SSDEEP
  
  12288:441TXKOrbNfYJmiyjjM0xdeTOLG9vZ23F:4kTaO3NfSmiyjIsm5xQF
Score

8^/10

evasion persistence
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2