dcb976953832722db83c2885a67b66f42a0d6331ec15dce89f53f910c5a0efc9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c7654295b601565ad96b385d5a7b2e2a
Size

29KB
Sample

240314-cevg5afg6y
MD5

c7654295b601565ad96b385d5a7b2e2a
SHA1

8653cd488feeded8b951be9d25fd3987ed2ab437
SHA256

dcb976953832722db83c2885a67b66f42a0d6331ec15dce89f53f910c5a0efc9
SHA512

fe9eb8424e8e07a6b1f01ea91f334c33712f2290a2fe0a64bd7237a3dc4f3d52e5c8c4944f39b696ccb2f20e4590430468f69d43ff214c33fb7a7666107e63f3
SSDEEP

768:vvt81TwZIld2coTvxvuku3tV+YxfkYxcn3z9:vvkTtr4xydhx3cn5

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  c7654295b601565ad96b385d5a7b2e2a
- Size
  
  29KB
- MD5
  
  c7654295b601565ad96b385d5a7b2e2a
- SHA1
  
  8653cd488feeded8b951be9d25fd3987ed2ab437
- SHA256
  
  dcb976953832722db83c2885a67b66f42a0d6331ec15dce89f53f910c5a0efc9
- SHA512
  
  fe9eb8424e8e07a6b1f01ea91f334c33712f2290a2fe0a64bd7237a3dc4f3d52e5c8c4944f39b696ccb2f20e4590430468f69d43ff214c33fb7a7666107e63f3
- SSDEEP
  
  768:vvt81TwZIld2coTvxvuku3tV+YxfkYxcn3z9:vvkTtr4xydhx3cn5
Score

8^/10

evasion persistence
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- Stops running service(s)
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2

evasionpersistence