adwind | 8fd78f6d61a3486347c76e683469cbab399fb6a9225800b14eabf3245655aa27 | Triage

Sharing

General

Target

m17145806439048438949256317482622.tmp
Size

639KB
Sample

240501-t64zbadf42
MD5

ede9ffe877c82c98b4c5cc8459a2b386
SHA1

0513ca93d9d64749b065abed494a153cef9ec1b5
SHA256

8fd78f6d61a3486347c76e683469cbab399fb6a9225800b14eabf3245655aa27
SHA512

d5082570ee2cdff7439edc3c5d5ea7a653820a9df85d97b953f176a238321256315220c97f2ebbd9ac423869216038826946bed19869aadb322d56bea0afb834
SSDEEP

12288:CXbhQt/rTVAnp4lhApkfgy/nRr+hPINKzegeFGRF03Yug2RMSyJDwt:CXtQtNAp4XzfgyZGSKznIVYutRPyJDwt

Score

10^/10

adwind discovery persistence

Malware Config

Targets

- Target
  
  m17145806439048438949256317482622.tmp
- Size
  
  639KB
- MD5
  
  ede9ffe877c82c98b4c5cc8459a2b386
- SHA1
  
  0513ca93d9d64749b065abed494a153cef9ec1b5
- SHA256
  
  8fd78f6d61a3486347c76e683469cbab399fb6a9225800b14eabf3245655aa27
- SHA512
  
  d5082570ee2cdff7439edc3c5d5ea7a653820a9df85d97b953f176a238321256315220c97f2ebbd9ac423869216038826946bed19869aadb322d56bea0afb834
- SSDEEP
  
  12288:CXbhQt/rTVAnp4lhApkfgy/nRr+hPINKzegeFGRF03Yug2RMSyJDwt:CXtQtNAp4XzfgyZGSKznIVYutRPyJDwt
Score

7^/10

discovery persistence
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence