ff086d3b8ae0fa36ab7eeb8403d2c3679c11679a9daa77b742bc04dd623a7593 | Triage

Sharing

General

Target

Funk.exe
Size

1.2MB
Sample

240628-p8qggstdpn
MD5

16ae310b82d8c97b1109ef8441e7804c
SHA1

28575cb85757148503be1ba66020d410ea4a637e
SHA256

ff086d3b8ae0fa36ab7eeb8403d2c3679c11679a9daa77b742bc04dd623a7593
SHA512

0c7a354e853e75b50ad216df39db969c1b79fadd5e5c467fe23ff03ed69831d28405141827df47a301987ad2129cd00a6482ee2b00982579ae7ba7b6608538c8
SSDEEP

24576:053uhFzvId2DW/xbqX2YIbzQsu3/PNLIQFHyBvGThpZYM:05+hFQ2EmXGQsW/PN0QNlZn

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  Funk.exe
- Size
  
  1.2MB
- MD5
  
  16ae310b82d8c97b1109ef8441e7804c
- SHA1
  
  28575cb85757148503be1ba66020d410ea4a637e
- SHA256
  
  ff086d3b8ae0fa36ab7eeb8403d2c3679c11679a9daa77b742bc04dd623a7593
- SHA512
  
  0c7a354e853e75b50ad216df39db969c1b79fadd5e5c467fe23ff03ed69831d28405141827df47a301987ad2129cd00a6482ee2b00982579ae7ba7b6608538c8
- SSDEEP
  
  24576:053uhFzvId2DW/xbqX2YIbzQsu3/PNLIQFHyBvGThpZYM:05+hFQ2EmXGQsW/PN0QNlZn
Score

10^/10

evasion persistence
- Modifies security service
  evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence