f1787b9553ce260b889cbb40b456d62f2cfa01b10f7e512a3528790c65640669 | Triage

Sharing

General

Target

RapeLay_BIa-QZ1.exe
Size

13.8MB
Sample

240818-trfm6svgkm
MD5

f3f16a12cdaf4e3fe51bece5dff8970f
SHA1

e4bb36e12d8f566617f940c32764870e052a89b7
SHA256

f1787b9553ce260b889cbb40b456d62f2cfa01b10f7e512a3528790c65640669
SHA512

5b5837ee05f3a16c645613c5e0462b6d81d6e1dc183156b790e42cd8348fa6b391bdc84de43131cba4c568aba2be308d6e3020c829df0f11d44fd923f8cd827f
SSDEEP

393216:MBBTeN30LpEiSCC9XSpIFwah3RuINhkU9he:ktwkLps9Xhrhhuahk7

Score

6^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  RapeLay_BIa-QZ1.exe
- Size
  
  13.8MB
- MD5
  
  f3f16a12cdaf4e3fe51bece5dff8970f
- SHA1
  
  e4bb36e12d8f566617f940c32764870e052a89b7
- SHA256
  
  f1787b9553ce260b889cbb40b456d62f2cfa01b10f7e512a3528790c65640669
- SHA512
  
  5b5837ee05f3a16c645613c5e0462b6d81d6e1dc183156b790e42cd8348fa6b391bdc84de43131cba4c568aba2be308d6e3020c829df0f11d44fd923f8cd827f
- SSDEEP
  
  393216:MBBTeN30LpEiSCC9XSpIFwah3RuINhkU9he:ktwkLps9Xhrhhuahk7
Score

6^/10

discovery evasion persistence privilege_escalation
- Checks for any installed AV software in registry
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Windows Firewall
  evasion
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Software Discovery

Security Software Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation