2cecb9286f6a283b613be114784fdc6f2e2931127a2e8887e65d608453b80a57 | Triage

Sharing

General

Target

Virus.Hijack.ATA_virussign.com_4b84d8ac8186a22ca478ef8a0cdcd797.exe
Size

67KB
Sample

240907-p1wzaswfrn
MD5

4b84d8ac8186a22ca478ef8a0cdcd797
SHA1

e59bcffc28d2b73c25ed59843afc16d942434159
SHA256

2cecb9286f6a283b613be114784fdc6f2e2931127a2e8887e65d608453b80a57
SHA512

fec10b6022c6fb1acda471f21abead7f65fb8ab355e4b94f2470d93ce28e7b45d12d785966275351311bedc9b1e0dda537a0197c4aaf21ed116e9fdfdbb616c9
SSDEEP

768:CKUhxNZL/MLdSvgQd3bqv0zRnSzbJ0CvmZsJ1vITpRdSd8uCoMFS/1H5GMXdnhP0:CKUhxXMSxzzdSHiW2QGuzom1cgCe8uC

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  Virus.Hijack.ATA_virussign.com_4b84d8ac8186a22ca478ef8a0cdcd797.exe
- Size
  
  67KB
- MD5
  
  4b84d8ac8186a22ca478ef8a0cdcd797
- SHA1
  
  e59bcffc28d2b73c25ed59843afc16d942434159
- SHA256
  
  2cecb9286f6a283b613be114784fdc6f2e2931127a2e8887e65d608453b80a57
- SHA512
  
  fec10b6022c6fb1acda471f21abead7f65fb8ab355e4b94f2470d93ce28e7b45d12d785966275351311bedc9b1e0dda537a0197c4aaf21ed116e9fdfdbb616c9
- SSDEEP
  
  768:CKUhxNZL/MLdSvgQd3bqv0zRnSzbJ0CvmZsJ1vITpRdSd8uCoMFS/1H5GMXdnhP0:CKUhxXMSxzzdSHiW2QGuzom1cgCe8uC
Score

10^/10

discovery persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence