18c9f8d3e0a00df011469f04be68a8fcde8f06c8bdd326425d3338e2a232cab8 | Triage

Sharing

General

Target

18c9f8d3e0a00df011469f04be68a8fcde8f06c8bdd326425d3338e2a232cab8
Size

136KB
Sample

240824-ymjaqawfje
MD5

bafed6bf28f48003a664b1edf831ff01
SHA1

b15eb8d5f68159eaba72c83a61c6e5847701164a
SHA256

18c9f8d3e0a00df011469f04be68a8fcde8f06c8bdd326425d3338e2a232cab8
SHA512

963cfdf5450ff055c4bfce970e4cf35a5f764a33b4926bec38acf38d382bfdc8491cecc3b81b0db458627b548d845b942b461d6009e28257637cfd38df24e066
SSDEEP

3072:OTO5LYTivQ8mF4O0CWkHjsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:OcLYevQN0cjsohxd2Quohdbd0zscj

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  18c9f8d3e0a00df011469f04be68a8fcde8f06c8bdd326425d3338e2a232cab8
- Size
  
  136KB
- MD5
  
  bafed6bf28f48003a664b1edf831ff01
- SHA1
  
  b15eb8d5f68159eaba72c83a61c6e5847701164a
- SHA256
  
  18c9f8d3e0a00df011469f04be68a8fcde8f06c8bdd326425d3338e2a232cab8
- SHA512
  
  963cfdf5450ff055c4bfce970e4cf35a5f764a33b4926bec38acf38d382bfdc8491cecc3b81b0db458627b548d845b942b461d6009e28257637cfd38df24e066
- SSDEEP
  
  3072:OTO5LYTivQ8mF4O0CWkHjsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:OcLYevQN0cjsohxd2Quohdbd0zscj
Score

10^/10

discovery persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence