61dcfda4694ea3f6bafab018feb9cbcaced299f1996b4a7adaf79a3a81cc788d | Triage

Sharing

General

Target

61dcfda4694ea3f6bafab018feb9cbcaced299f1996b4a7adaf79a3a81cc788d.exe
Size

806KB
Sample

240809-xe42saxhmf
MD5

9cef532829a4ca2cf13279ac134873d8
SHA1

68f4c94bf29fb0cbde97973083f85bf08382f2a2
SHA256

61dcfda4694ea3f6bafab018feb9cbcaced299f1996b4a7adaf79a3a81cc788d
SHA512

f938aa8fddeac26fc862c1bd312ac2ef57843e7922b4e14b4b69b8db9888bf250f5572df79fe13710df89293c116da144d7da90d0783b8e85e56d0791607d1b5
SSDEEP

12288:QQT9bUbPgROCAVtagRJGYkCLVaZxnHo6o0L9eC/CgDCJc2Lg:jTZOPgROAitkCQjH1e2n2Lg

Score

8^/10

discovery execution persistence

Malware Config

Targets

- Target
  
  61dcfda4694ea3f6bafab018feb9cbcaced299f1996b4a7adaf79a3a81cc788d.exe
- Size
  
  806KB
- MD5
  
  9cef532829a4ca2cf13279ac134873d8
- SHA1
  
  68f4c94bf29fb0cbde97973083f85bf08382f2a2
- SHA256
  
  61dcfda4694ea3f6bafab018feb9cbcaced299f1996b4a7adaf79a3a81cc788d
- SHA512
  
  f938aa8fddeac26fc862c1bd312ac2ef57843e7922b4e14b4b69b8db9888bf250f5572df79fe13710df89293c116da144d7da90d0783b8e85e56d0791607d1b5
- SSDEEP
  
  12288:QQT9bUbPgROCAVtagRJGYkCLVaZxnHo6o0L9eC/CgDCJc2Lg:jTZOPgROAitkCQjH1e2n2Lg
Score

8^/10

discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  Planular/opencv_ml2410.dll
- Size
  
  589KB
- MD5
  
  b594b796565158e677eb91827faa7fb6
- SHA1
  
  6d4b7c9942733837c5354731d7b2ed21676b9971
- SHA256
  
  4bbc2904dd371073bbd411aa76be0e73dfdd445f2c61efe63f55085781813cbf
- SHA512
  
  4c9b8fa5ea54660390943a4a0c7141ef4169629f52849a07be9010b7453990c7688b2d0c2c61b2fdb8193ad479f1d29b34723659dc41235a60795b7bb1a2d74b
- SSDEEP
  
  12288:NyIaXe9xfExypragYbRwtFOD1AUPI6m6Ldq5iU1FwX9YYG2:NyRX4raLGQ1Az6m6Ldq5iyqYYG
Score

1^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecutionpersistence

behavioral2

discoveryexecution

behavioral3

behavioral4