f924b02b714e3b714c72d130369751761b5d09c49b08468db9b232ca86acfd93 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f924b02b714e3b714c72d130369751761b5d09c49b08468db9b232ca86acfd93
Size

479KB
Sample

240706-fm56dayekh
MD5

345e7c09be75c32cee7a5d861ebfc4f6
SHA1

0fd5be51e70121fb2c64230e183ffae0e9954895
SHA256

f924b02b714e3b714c72d130369751761b5d09c49b08468db9b232ca86acfd93
SHA512

d6179df87863238d902ee9d278344fd9237e9b431cdb30c4462622c22c6dbe214f051d928b690a4ae81f14fc8c64d2cffb711a88bf26012c285cfff87d2771a6
SSDEEP

6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDnWZn:nRDc3yWDNU+YUznzNjElWaT07NQtDWZn

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  f924b02b714e3b714c72d130369751761b5d09c49b08468db9b232ca86acfd93
- Size
  
  479KB
- MD5
  
  345e7c09be75c32cee7a5d861ebfc4f6
- SHA1
  
  0fd5be51e70121fb2c64230e183ffae0e9954895
- SHA256
  
  f924b02b714e3b714c72d130369751761b5d09c49b08468db9b232ca86acfd93
- SHA512
  
  d6179df87863238d902ee9d278344fd9237e9b431cdb30c4462622c22c6dbe214f051d928b690a4ae81f14fc8c64d2cffb711a88bf26012c285cfff87d2771a6
- SSDEEP
  
  6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDnWZn:nRDc3yWDNU+YUznzNjElWaT07NQtDWZn
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Sets service image path in registry
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence