b2d2f47544f796503996739d58aec8de2835c6c530184396805cca706910af08 | Triage

Sharing

General

Target

9333f9d8f70f473b16c62386c0123980N.exe
Size

1.4MB
Sample

240814-xg5fbsyaja
MD5

9333f9d8f70f473b16c62386c0123980
SHA1

a7a765700b445e19e96cf170e451225684aa0ee9
SHA256

b2d2f47544f796503996739d58aec8de2835c6c530184396805cca706910af08
SHA512

5f7c570581f63c23187eaebe22de09e3f33591e28056ba30d77baacc6d4d03eb71e6213da16e126adf39808b7493142c840c4569cea18a1e1878d287440f7059
SSDEEP

24576:l9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlMe:l9UX1uBx4mYo83vOSeyeaKrM

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  9333f9d8f70f473b16c62386c0123980N.exe
- Size
  
  1.4MB
- MD5
  
  9333f9d8f70f473b16c62386c0123980
- SHA1
  
  a7a765700b445e19e96cf170e451225684aa0ee9
- SHA256
  
  b2d2f47544f796503996739d58aec8de2835c6c530184396805cca706910af08
- SHA512
  
  5f7c570581f63c23187eaebe22de09e3f33591e28056ba30d77baacc6d4d03eb71e6213da16e126adf39808b7493142c840c4569cea18a1e1878d287440f7059
- SSDEEP
  
  24576:l9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlMe:l9UX1uBx4mYo83vOSeyeaKrM
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence