9e8f0edc2f018fd0890dbc1a451abe9f32fbbda47dd7e8dbdd44f8e5dcca2955 | Triage

Sharing

General

Target

cs16_setup_rus.exe
Size

241.0MB
Sample

240807-h4nzjavaqm
MD5

c438f464db5b6d21df1176e85d40ba91
SHA1

2d43a6c6a981dff4ce8ceef1723c81c073aca634
SHA256

9e8f0edc2f018fd0890dbc1a451abe9f32fbbda47dd7e8dbdd44f8e5dcca2955
SHA512

f6a2fd8d1e85c3e903efdb544a18b2ff2295fc0c3547d1ef56753f8b1bcd8ee4ffde98fae1ca317d3e3371811f97bafd0afbfc4d04fab41879a4f35dc8128a42
SSDEEP

6291456:UjYqMmFu7JqgEINtHzM1FrxEAp6y9a66D2Zehnhr/H:U4mFuggzzorR84a2AHrf

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  cs16_setup_rus.exe
- Size
  
  241.0MB
- MD5
  
  c438f464db5b6d21df1176e85d40ba91
- SHA1
  
  2d43a6c6a981dff4ce8ceef1723c81c073aca634
- SHA256
  
  9e8f0edc2f018fd0890dbc1a451abe9f32fbbda47dd7e8dbdd44f8e5dcca2955
- SHA512
  
  f6a2fd8d1e85c3e903efdb544a18b2ff2295fc0c3547d1ef56753f8b1bcd8ee4ffde98fae1ca317d3e3371811f97bafd0afbfc4d04fab41879a4f35dc8128a42
- SSDEEP
  
  6291456:UjYqMmFu7JqgEINtHzM1FrxEAp6y9a66D2Zehnhr/H:U4mFuggzzorR84a2AHrf
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation