281f85e98e5662bb1190d0f99d3e873ab4aa97061b160b0d13e417675174c59e | Triage

Sharing

General

Target

ce90b3d8f2c824d0c0532de00c62a3d0N
Size

206KB
Sample

240908-e7bltsyelf
MD5

ce90b3d8f2c824d0c0532de00c62a3d0
SHA1

6dcd89dd6b44e52100aedd2ea986782d59fdbcef
SHA256

281f85e98e5662bb1190d0f99d3e873ab4aa97061b160b0d13e417675174c59e
SHA512

b8e9ab8aa8073c3610ba2fb441aa37b01f7a9d70eedbb728e2600c4cf0a7d3c40041ea66474d5ed1586700d85b0e40bcb55390ceb781c6f8afc381f361468de9
SSDEEP

3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unp:zvEN2U+T6i5LirrllHy4HUcMQY6O

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ce90b3d8f2c824d0c0532de00c62a3d0N
- Size
  
  206KB
- MD5
  
  ce90b3d8f2c824d0c0532de00c62a3d0
- SHA1
  
  6dcd89dd6b44e52100aedd2ea986782d59fdbcef
- SHA256
  
  281f85e98e5662bb1190d0f99d3e873ab4aa97061b160b0d13e417675174c59e
- SHA512
  
  b8e9ab8aa8073c3610ba2fb441aa37b01f7a9d70eedbb728e2600c4cf0a7d3c40041ea66474d5ed1586700d85b0e40bcb55390ceb781c6f8afc381f361468de9
- SSDEEP
  
  3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unp:zvEN2U+T6i5LirrllHy4HUcMQY6O
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence