c1a55ed664f378c12560c5992b557edb675417bd4b28fc91e7927ac24e3376e6 | Triage

Sharing

General

Target

c87de593d0dbc26df38f8af93c65cc36
Size

38KB
Sample

240314-ngfyasch53
MD5

c87de593d0dbc26df38f8af93c65cc36
SHA1

b6bb1d606b741b28bd95346902ec3441ae4d58d6
SHA256

c1a55ed664f378c12560c5992b557edb675417bd4b28fc91e7927ac24e3376e6
SHA512

c1ebaad2e12292a0ee5a41c88e041dd7f41c774627dd55dd9193e2424507ca03daaefb198be932552574c6ba61c7d60e966fb4d2f6896138044cc2600192d573
SSDEEP

768:YU5ChYknJSDX474YqS2Ir2iZlaNdCLCCHqDHiabUOHcaUD1Vcopm:YUsJnsM74FSPTZlaWCCHiCabUO8nD1R4

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  c87de593d0dbc26df38f8af93c65cc36
- Size
  
  38KB
- MD5
  
  c87de593d0dbc26df38f8af93c65cc36
- SHA1
  
  b6bb1d606b741b28bd95346902ec3441ae4d58d6
- SHA256
  
  c1a55ed664f378c12560c5992b557edb675417bd4b28fc91e7927ac24e3376e6
- SHA512
  
  c1ebaad2e12292a0ee5a41c88e041dd7f41c774627dd55dd9193e2424507ca03daaefb198be932552574c6ba61c7d60e966fb4d2f6896138044cc2600192d573
- SSDEEP
  
  768:YU5ChYknJSDX474YqS2Ir2iZlaNdCLCCHqDHiabUOHcaUD1Vcopm:YUsJnsM74FSPTZlaWCCHiCabUO8nD1R4
Score

8^/10

evasion persistence
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence