1838d564a975fa0c341a4849b8ee1770be6ed48e8d1a0c2a0d8a4e67cc8f567f | Triage

Sharing

General

Target

cool.exe
Size

27KB
Sample

240908-nt3b3awflb
MD5

1ee7cc05d97af21a41db79474906ba91
SHA1

9a6434526b3d4766d044da5753de220be164eca1
SHA256

1838d564a975fa0c341a4849b8ee1770be6ed48e8d1a0c2a0d8a4e67cc8f567f
SHA512

cff758f21406bcbdd1b6a7a749462a751a511e373ef61b978bb5d1ebcd46612f3e53c33de014d473ee623b5445ba03a695252ce354f3fd02f93a9ac996387fea
SSDEEP

384:dNqGSj1dStBzyUt5Ldxhw+LGlMz/T/oO7Waqf+BvvE9q+cNB0zS0i5RT44:WGSjeIs++L2MIO78+Bk94zM4

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  cool.exe
- Size
  
  27KB
- MD5
  
  1ee7cc05d97af21a41db79474906ba91
- SHA1
  
  9a6434526b3d4766d044da5753de220be164eca1
- SHA256
  
  1838d564a975fa0c341a4849b8ee1770be6ed48e8d1a0c2a0d8a4e67cc8f567f
- SHA512
  
  cff758f21406bcbdd1b6a7a749462a751a511e373ef61b978bb5d1ebcd46612f3e53c33de014d473ee623b5445ba03a695252ce354f3fd02f93a9ac996387fea
- SSDEEP
  
  384:dNqGSj1dStBzyUt5Ldxhw+LGlMz/T/oO7Waqf+BvvE9q+cNB0zS0i5RT44:WGSjeIs++L2MIO78+Bk94zM4
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation