4b4e72a5e8915429c77cad16cea92c3e128895e50e308fbd21b8a75c750e2e1b | Triage

Sharing

General

Target

OpenIVSetup_offline.rar
Size

29.5MB
Sample

240704-3pa5cawdlm
MD5

4f979801f207fcaa5bb30160f0de9907
SHA1

738da1c0c577f24f48c5daa575863c4da193368b
SHA256

4b4e72a5e8915429c77cad16cea92c3e128895e50e308fbd21b8a75c750e2e1b
SHA512

264ac2f47568a6860139e5a74b2730e2309233ac08a7138fb3d1fd19dd76f5488a0596f3dd5c417dd38b6c7ac4f1ce74e89118aeff623abf5ae87e2193cd3776
SSDEEP

786432:FAaY15IpEwSO8Q9HdprFjW/EsOant965M/5HQGAGxCj:FArIfrB99prFyt9eM/5/g

Score

7^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  OpenIVSetup.exe
- Size
  
  33.0MB
- MD5
  
  58446a05397f2b391ad66c18ac42dd46
- SHA1
  
  fbca2ceb4da791983c133d54b44e9f8191b18260
- SHA256
  
  3683b717c0651a35fe3a0a5cf8a0a20f19e8a848675005fb08d0152b29857616
- SHA512
  
  f5fb192726a75051bb2cdb101a9ec85bbf7015d70568caacd32d9af64690ae6503c7699d860b611275005c3997de6fae1e4490990a40d12d1a7b836db852d991
- SSDEEP
  
  786432:JpY72Jimx2oeNm9iePejodLaYLCaYYXTU2vKBorzDa:eUfPeNm9mqHLqYj7a
Score

7^/10

evasion persistence trojan
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2