b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74 | Triage

Sharing

General

Target

b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74
Size

1.4MB
Sample

240726-crr8jatbqd
MD5

f2af0cf68dfd2a651cc66ad92ea4524a
SHA1

95ccb921e2f012b426ee89b1901b28ef661d93eb
SHA256

b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74
SHA512

4cade9d6e64030d5bfb1dffe451efbba70c8c1a7d77b945fdd364870773504c634efc3a662b1ae2b2ceb1c39939a47efbb545ba65a1c634330df181119fac198
SSDEEP

24576:T9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlM+:T9UX1uBx4mYo83vOSeyeaKrE

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74
- Size
  
  1.4MB
- MD5
  
  f2af0cf68dfd2a651cc66ad92ea4524a
- SHA1
  
  95ccb921e2f012b426ee89b1901b28ef661d93eb
- SHA256
  
  b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74
- SHA512
  
  4cade9d6e64030d5bfb1dffe451efbba70c8c1a7d77b945fdd364870773504c634efc3a662b1ae2b2ceb1c39939a47efbb545ba65a1c634330df181119fac198
- SSDEEP
  
  24576:T9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlM+:T9UX1uBx4mYo83vOSeyeaKrE
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence