120c9389731ad3819715a1a268c3cb14db938483d99ee92e6dd16074b30a4d41 | Triage

Sharing

General

Target

120c9389731ad3819715a1a268c3cb14db938483d99ee92e6dd16074b30a4d41.exe
Size

152KB
Sample

240726-sqr45swblk
MD5

1009eec443d9e621a5b3dc3b5680a1d8
SHA1

51d0505457ad9a2d4acbc7c4385d72babd3b4806
SHA256

120c9389731ad3819715a1a268c3cb14db938483d99ee92e6dd16074b30a4d41
SHA512

f201dbdf9e6525d9ee0ecc2ee3416963518c0a853c7873052dd4d3e30baa895290ee0ce52e01cc91efaa1f5cd71e58cce5a287b490476ea0aa84efb45682e9dd
SSDEEP

3072:mtWZqwoa9Xa1Idart19RdWQnyuuHn6LH1al3:mtxIqqdtQnyucn6LMd

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  120c9389731ad3819715a1a268c3cb14db938483d99ee92e6dd16074b30a4d41.exe
- Size
  
  152KB
- MD5
  
  1009eec443d9e621a5b3dc3b5680a1d8
- SHA1
  
  51d0505457ad9a2d4acbc7c4385d72babd3b4806
- SHA256
  
  120c9389731ad3819715a1a268c3cb14db938483d99ee92e6dd16074b30a4d41
- SHA512
  
  f201dbdf9e6525d9ee0ecc2ee3416963518c0a853c7873052dd4d3e30baa895290ee0ce52e01cc91efaa1f5cd71e58cce5a287b490476ea0aa84efb45682e9dd
- SSDEEP
  
  3072:mtWZqwoa9Xa1Idart19RdWQnyuuHn6LH1al3:mtxIqqdtQnyucn6LMd
Score

8^/10

discovery persistence
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence