0142750bbed30093a401408496f57b7bf6e2a8c06c9172fc9eecf682f11ea9c6 | Triage

Sharing

General

Target

0142750bbed30093a401408496f57b7bf6e2a8c06c9172fc9eecf682f11ea9c6.exe
Size

1.7MB
Sample

240524-yrjr2shf22
MD5

6f9693323279dafac91f050a0a65db34
SHA1

4655dfa3f88a95a1ba09c3a5cfa6c55815a867f6
SHA256

0142750bbed30093a401408496f57b7bf6e2a8c06c9172fc9eecf682f11ea9c6
SHA512

d3d1da330b19c969ef469a657192988a1eb6e9690cb3cdbe357bb45b30960987fd30d6635ac6cff8bebaaa79b19ef6a7528f12c382c8f7c37bd99bd1a9ae54db
SSDEEP

24576:UuhaueZJ8NI85eZJ8NI8DerQZb+md4wmEeZJ8NI85eZJ8NI8DerQZb+md4wmev:be8u8DerQZbd2F8u8DerQZbd2Kv

Score

10^/10

evasion execution persistence

Malware Config

Targets

- Target
  
  0142750bbed30093a401408496f57b7bf6e2a8c06c9172fc9eecf682f11ea9c6.exe
- Size
  
  1.7MB
- MD5
  
  6f9693323279dafac91f050a0a65db34
- SHA1
  
  4655dfa3f88a95a1ba09c3a5cfa6c55815a867f6
- SHA256
  
  0142750bbed30093a401408496f57b7bf6e2a8c06c9172fc9eecf682f11ea9c6
- SHA512
  
  d3d1da330b19c969ef469a657192988a1eb6e9690cb3cdbe357bb45b30960987fd30d6635ac6cff8bebaaa79b19ef6a7528f12c382c8f7c37bd99bd1a9ae54db
- SSDEEP
  
  24576:UuhaueZJ8NI85eZJ8NI8DerQZb+md4wmEeZJ8NI85eZJ8NI8DerQZb+md4wmev:be8u8DerQZbd2F8u8DerQZbd2Kv
Score

10^/10

evasion execution persistence
- Disables service(s)
  evasion execution
- Modifies visibility of file extensions in Explorer
  evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistence

behavioral2

evasionexecutionpersistence