73eab7c739e178ac84370b78bcc5b969c693637144ae25ba56895a6ce28bc9db | Triage

Sharing

General

Target

c7b8c224a6cabae31557182788f7442a
Size

440KB
Sample

240314-fc77zsag7v
MD5

c7b8c224a6cabae31557182788f7442a
SHA1

b87bba5303a93b2f7d41037e864d81c208e955b8
SHA256

73eab7c739e178ac84370b78bcc5b969c693637144ae25ba56895a6ce28bc9db
SHA512

149db0b4a49f7234d1061b896f305da80abde917923b860bb1dc390952fbf3ee3609ae63150d10e6d0c273bbc48c46ce721aadb1a5be3a1429e49f8a7b9a5f26
SSDEEP

12288:tHM3/vAAOhOnYlPyeuKuUmNMt5wDUVDdFo:tHMvvA7OYGUke5HVDY

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  c7b8c224a6cabae31557182788f7442a
- Size
  
  440KB
- MD5
  
  c7b8c224a6cabae31557182788f7442a
- SHA1
  
  b87bba5303a93b2f7d41037e864d81c208e955b8
- SHA256
  
  73eab7c739e178ac84370b78bcc5b969c693637144ae25ba56895a6ce28bc9db
- SHA512
  
  149db0b4a49f7234d1061b896f305da80abde917923b860bb1dc390952fbf3ee3609ae63150d10e6d0c273bbc48c46ce721aadb1a5be3a1429e49f8a7b9a5f26
- SSDEEP
  
  12288:tHM3/vAAOhOnYlPyeuKuUmNMt5wDUVDdFo:tHMvvA7OYGUke5HVDY
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Modifies Installed Components in the registry
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence