9f216a073f8083a2525597ade8f3da6f3a629e567f8f88483d1990d22b237b99 | Triage

Sharing

General

Target

37803ea7055ac72b1d89f95a61407b00N.exe
Size

63KB
Sample

240724-chxfwssbrm
MD5

37803ea7055ac72b1d89f95a61407b00
SHA1

be4c61a1394437bc523815b3ef9186d9b72f4f1d
SHA256

9f216a073f8083a2525597ade8f3da6f3a629e567f8f88483d1990d22b237b99
SHA512

bf927392d9517ca14bc3c5165201853f0df5c4d65abbd1c55bc22e8e15a0414ffdfbd1c01cff47d92b274f38d4c395a61a8b39ef4984c35b787b44c30158a203
SSDEEP

384:5EueqcNOpLsz3YN6RTqjTPJOGjMuPr8JMD+jQLv5OzeXy:SueqsOpLszoFvwUQJCy25eeXy

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  37803ea7055ac72b1d89f95a61407b00N.exe
- Size
  
  63KB
- MD5
  
  37803ea7055ac72b1d89f95a61407b00
- SHA1
  
  be4c61a1394437bc523815b3ef9186d9b72f4f1d
- SHA256
  
  9f216a073f8083a2525597ade8f3da6f3a629e567f8f88483d1990d22b237b99
- SHA512
  
  bf927392d9517ca14bc3c5165201853f0df5c4d65abbd1c55bc22e8e15a0414ffdfbd1c01cff47d92b274f38d4c395a61a8b39ef4984c35b787b44c30158a203
- SSDEEP
  
  384:5EueqcNOpLsz3YN6RTqjTPJOGjMuPr8JMD+jQLv5OzeXy:SueqsOpLszoFvwUQJCy25eeXy
Score

8^/10

discovery persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

AppInit DLLs

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation