20fefe9d6d92a6dd574bf184f0df95dcc356fc0f581909d891f9bea81ee80607 | Triage

Sharing

General

Target

2b6e3fc4861b27081db46872780f6af0N.exe
Size

352KB
Sample

240821-ccyrrsvbpd
MD5

2b6e3fc4861b27081db46872780f6af0
SHA1

2268bbe62144b21e6edbd072840f0d6a01849457
SHA256

20fefe9d6d92a6dd574bf184f0df95dcc356fc0f581909d891f9bea81ee80607
SHA512

1302e2a631ff0c4958a99558dd6d297079eeef95248c52c878c83db64a179d3e1f1f162cc783f205b43b197dec0cf85e4a146a5e8ed79a1d08c2a33b43223a3a
SSDEEP

6144:/Is9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCe8i:KKofHfHTXQLzgvnzHPowYbvrjD/L7QPs

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  2b6e3fc4861b27081db46872780f6af0N.exe
- Size
  
  352KB
- MD5
  
  2b6e3fc4861b27081db46872780f6af0
- SHA1
  
  2268bbe62144b21e6edbd072840f0d6a01849457
- SHA256
  
  20fefe9d6d92a6dd574bf184f0df95dcc356fc0f581909d891f9bea81ee80607
- SHA512
  
  1302e2a631ff0c4958a99558dd6d297079eeef95248c52c878c83db64a179d3e1f1f162cc783f205b43b197dec0cf85e4a146a5e8ed79a1d08c2a33b43223a3a
- SSDEEP
  
  6144:/Is9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCe8i:KKofHfHTXQLzgvnzHPowYbvrjD/L7QPs
Score

7^/10

discovery persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence