f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be

User tags

Assigned on submission by the user, not by sandbox detections.

Threatview.io Proactive Hunter

Sharing

Copy URL

Twitter E-mail

General

Target

klkjjk.exe.2
Size

3.9MB
Sample

240425-gfm7nagc43
MD5

0d28c308c7d3af1f50a24cd98d59adbe
SHA1

617eb940a77fffe2e8363f9a11430ebb56b4c988
SHA256

f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be
SHA512

d71da6edef67bc977ac8564f75cc0e8cdd31c0a9b37253017122f522c4d2f1ece5d8a56642dab40e3d8651ad1d1233ba0a27f78a536ddf897ddd392dbebb5ae8
SSDEEP

49152:/YQ9p/TMILu3UAJvYIJ7PBJw47zI8gFEtYnEZhNa+uOTapp5pP7eoi:DpgQEZPPT4Yj

Score

8^/10

Malware Config

Targets

- Target
  
  klkjjk.exe.2
- Size
  
  3.9MB
- MD5
  
  0d28c308c7d3af1f50a24cd98d59adbe
- SHA1
  
  617eb940a77fffe2e8363f9a11430ebb56b4c988
- SHA256
  
  f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be
- SHA512
  
  d71da6edef67bc977ac8564f75cc0e8cdd31c0a9b37253017122f522c4d2f1ece5d8a56642dab40e3d8651ad1d1233ba0a27f78a536ddf897ddd392dbebb5ae8
- SSDEEP
  
  49152:/YQ9p/TMILu3UAJvYIJ7PBJw47zI8gFEtYnEZhNa+uOTapp5pP7eoi:DpgQEZPPT4Yj
Score

8^/10

evasion persistence microsoft phishing
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Adds Run key to start application
  persistence
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

User tags

Sharing

General

Malware Config

Targets

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Adds Run key to start application

Detected potential entity reuse from brand microsoft.

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2