e3b7f72cad8ce1ab44bf2082a3f0b211790f9cc3757e84053fbda09710b7c587 | Triage

Sharing

General

Target

d21245ac065eaacb39d32466e6a987e0N
Size

353KB
Sample

240912-mpx14sscln
MD5

d21245ac065eaacb39d32466e6a987e0
SHA1

fcddd5f048cb46ee4a4a5dc2da3e7ba9349f92f3
SHA256

e3b7f72cad8ce1ab44bf2082a3f0b211790f9cc3757e84053fbda09710b7c587
SHA512

454d17a0a6c0b50a89fc354bbea2fc04adf66d35b0057de8ed5869045ae16d11040ea15d513dc1d513d049d138cfea809b54ebc8c6bba442cc896dc6ae7a7269
SSDEEP

3072:KYt8BdoraghZS2/iKM42om06agGR6VYOVjN/xHO07lSaWeyZhc3+:Ktd2nPvq7vfS6VNVjNJHJ7lSaWemc+

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  d21245ac065eaacb39d32466e6a987e0N
- Size
  
  353KB
- MD5
  
  d21245ac065eaacb39d32466e6a987e0
- SHA1
  
  fcddd5f048cb46ee4a4a5dc2da3e7ba9349f92f3
- SHA256
  
  e3b7f72cad8ce1ab44bf2082a3f0b211790f9cc3757e84053fbda09710b7c587
- SHA512
  
  454d17a0a6c0b50a89fc354bbea2fc04adf66d35b0057de8ed5869045ae16d11040ea15d513dc1d513d049d138cfea809b54ebc8c6bba442cc896dc6ae7a7269
- SSDEEP
  
  3072:KYt8BdoraghZS2/iKM42om06agGR6VYOVjN/xHO07lSaWeyZhc3+:Ktd2nPvq7vfS6VNVjNJHJ7lSaWemc+
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence