0c81f7d71edf18ecab3266e864dfb4d6ff5cd1dfa860e0e429ae35863bbf7130 | Triage

Sharing

General

Target

0c81f7d71edf18ecab3266e864dfb4d6ff5cd1dfa860e0e429ae35863bbf7130.exe
Size

26KB
Sample

240912-bnrl6atdjq
MD5

d30835e280c6b21a0ad79fb7be18daae
SHA1

be339e278cf923e99be3c923ed51cbcbd7650728
SHA256

0c81f7d71edf18ecab3266e864dfb4d6ff5cd1dfa860e0e429ae35863bbf7130
SHA512

a3d29016ff009045602382dcf617d7dbe1799ac08e7c44a961dc9b5bcffc45f237b34cdc00d97f8014e63fac65d034188c91afebf066ade571626c329f198471
SSDEEP

384:ltPfgjF0t2szvkQ5T936VcyQnuYTclTXpLDdp+Q5Gc/r5Q7qe8N+qToMgf5s+jlF:nzwsjkQLccHnuYTcxZtwQRa75fvjb

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  0c81f7d71edf18ecab3266e864dfb4d6ff5cd1dfa860e0e429ae35863bbf7130.exe
- Size
  
  26KB
- MD5
  
  d30835e280c6b21a0ad79fb7be18daae
- SHA1
  
  be339e278cf923e99be3c923ed51cbcbd7650728
- SHA256
  
  0c81f7d71edf18ecab3266e864dfb4d6ff5cd1dfa860e0e429ae35863bbf7130
- SHA512
  
  a3d29016ff009045602382dcf617d7dbe1799ac08e7c44a961dc9b5bcffc45f237b34cdc00d97f8014e63fac65d034188c91afebf066ade571626c329f198471
- SSDEEP
  
  384:ltPfgjF0t2szvkQ5T936VcyQnuYTclTXpLDdp+Q5Gc/r5Q7qe8N+qToMgf5s+jlF:nzwsjkQLccHnuYTcxZtwQRa75fvjb
Score

10^/10

discovery persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence