General

  • Target

    02d71235071789f260d71e0fed298b6fecf281112b368ca325f0bab3b3afff64

  • Size

    1.2MB

  • Sample

    240603-wr4fcaed5s

  • MD5

    1085666ab17d16fb72987a984d8ed81d

  • SHA1

    9843db6c8c00d55f356698938593abed38354ab8

  • SHA256

    02d71235071789f260d71e0fed298b6fecf281112b368ca325f0bab3b3afff64

  • SHA512

    e579870108ca812bd1bf5f395084bbfe917905b32c361a8b55a7a581db51215186cfbd75469085e549e06ba068dc3c0fc1a189b8d551dcd093178fcbbf92d9d7

  • SSDEEP

    24576:hj+cktriK2PVboYTicnT1SBb//wDKULTrhSFkOTu+FMJ:4SPVboYTVABjRGtSFruNJ

Score
10/10

Malware Config

Targets

    • Target

      02d71235071789f260d71e0fed298b6fecf281112b368ca325f0bab3b3afff64

    • Size

      1.2MB

    • MD5

      1085666ab17d16fb72987a984d8ed81d

    • SHA1

      9843db6c8c00d55f356698938593abed38354ab8

    • SHA256

      02d71235071789f260d71e0fed298b6fecf281112b368ca325f0bab3b3afff64

    • SHA512

      e579870108ca812bd1bf5f395084bbfe917905b32c361a8b55a7a581db51215186cfbd75469085e549e06ba068dc3c0fc1a189b8d551dcd093178fcbbf92d9d7

    • SSDEEP

      24576:hj+cktriK2PVboYTicnT1SBb//wDKULTrhSFkOTu+FMJ:4SPVboYTVABjRGtSFruNJ

    Score
    10/10
    • Modifies visiblity of hidden/system files in Explorer

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

2
T1112

Tasks