46c6eb029bd3dc328a327dbac6febe55bf0e047c615f8dcf4ef537368ece4877 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

46c6eb029bd3dc328a327dbac6febe55bf0e047c615f8dcf4ef537368ece4877
Size

1024KB
Sample

240808-k61r8asajr
MD5

4f8cf66ec92cbb69068a908ad325e604
SHA1

cfddb5f5c597ddd157e0007d00096e03ec8e0072
SHA256

46c6eb029bd3dc328a327dbac6febe55bf0e047c615f8dcf4ef537368ece4877
SHA512

e4a6bd27092021e9021d7ed8913306d2bf6a331d664a2953aac1514e2adcc264f248c7df8b9340927d72561b5b51b095675a725f2d267729c6dfe2aca0ccd879
SSDEEP

12288:x2JylsKTMW4VyPGDSBQkoZnkDf2So9tp8LUlFl5FpU:x2Jyxd4VR7of2SI8LUlFl5FpU

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  46c6eb029bd3dc328a327dbac6febe55bf0e047c615f8dcf4ef537368ece4877
- Size
  
  1024KB
- MD5
  
  4f8cf66ec92cbb69068a908ad325e604
- SHA1
  
  cfddb5f5c597ddd157e0007d00096e03ec8e0072
- SHA256
  
  46c6eb029bd3dc328a327dbac6febe55bf0e047c615f8dcf4ef537368ece4877
- SHA512
  
  e4a6bd27092021e9021d7ed8913306d2bf6a331d664a2953aac1514e2adcc264f248c7df8b9340927d72561b5b51b095675a725f2d267729c6dfe2aca0ccd879
- SSDEEP
  
  12288:x2JylsKTMW4VyPGDSBQkoZnkDf2So9tp8LUlFl5FpU:x2Jyxd4VR7of2SI8LUlFl5FpU
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence