a3d7d4d2892feca9b61a91f01957febcefe2f37ad742ab94b5babb77b4c70885 | Triage

Resubmissions

10/04/2024, 13:42

240410-qz2zlach2v 8

09/04/2024, 16:06

240409-tj6jmafb51 8

Sharing

General

Target

Setup.exe
Size

1.8MB
Sample

240410-qz2zlach2v
MD5

e11cfb400aff0c350b2afc4dba3c1169
SHA1

f036e2727c25162eb5ee712d16be60e7da2187fa
SHA256

a3d7d4d2892feca9b61a91f01957febcefe2f37ad742ab94b5babb77b4c70885
SHA512

63a60c9f42cf9f744248cb7d13f6496564990736bae4f4751a4f90bcca9778b06c2cf6ba56b60cd11f5dead2b763280bf3f250b3cf12ec3d59a220036a4ce6eb
SSDEEP

49152:3IaEdIq7j9Al3HgXjhFmNpuZ+2k4i12t7qoW4:3IaEdQ1eFFmNN2kmBqG

Score

8^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  Setup.exe
- Size
  
  1.8MB
- MD5
  
  e11cfb400aff0c350b2afc4dba3c1169
- SHA1
  
  f036e2727c25162eb5ee712d16be60e7da2187fa
- SHA256
  
  a3d7d4d2892feca9b61a91f01957febcefe2f37ad742ab94b5babb77b4c70885
- SHA512
  
  63a60c9f42cf9f744248cb7d13f6496564990736bae4f4751a4f90bcca9778b06c2cf6ba56b60cd11f5dead2b763280bf3f250b3cf12ec3d59a220036a4ce6eb
- SSDEEP
  
  49152:3IaEdIq7j9Al3HgXjhFmNpuZ+2k4i12t7qoW4:3IaEdQ1eFFmNN2kmBqG
Score

8^/10

discovery evasion persistence
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence