bcf78ce1ad49e168ab4d99e20ee50d68bf682f0285f2060d31a3cb6f245cc28a | Triage

Sharing

General

Target

bcf78ce1ad49e168ab4d99e20ee50d68bf682f0285f2060d31a3cb6f245cc28aN
Size

480KB
Sample

240920-gmkecascnj
MD5

b25bfe53ce3831a745c79795958a24f0
SHA1

a5d54c999dc53d0da2fce473e5b3b56ce9b9adef
SHA256

bcf78ce1ad49e168ab4d99e20ee50d68bf682f0285f2060d31a3cb6f245cc28a
SHA512

1b4fbba9159667464ff0fefe67548c04b8c998fd74eba354192f70e153a6658f06a633946c94f24b7e220f40aa7ece325a1711b46969439ce2733c30822f0fab
SSDEEP

6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDn7:nRDc3yWDNU+YUznzNjElWaT07NQtD7

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  bcf78ce1ad49e168ab4d99e20ee50d68bf682f0285f2060d31a3cb6f245cc28aN
- Size
  
  480KB
- MD5
  
  b25bfe53ce3831a745c79795958a24f0
- SHA1
  
  a5d54c999dc53d0da2fce473e5b3b56ce9b9adef
- SHA256
  
  bcf78ce1ad49e168ab4d99e20ee50d68bf682f0285f2060d31a3cb6f245cc28a
- SHA512
  
  1b4fbba9159667464ff0fefe67548c04b8c998fd74eba354192f70e153a6658f06a633946c94f24b7e220f40aa7ece325a1711b46969439ce2733c30822f0fab
- SSDEEP
  
  6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDn7:nRDc3yWDNU+YUznzNjElWaT07NQtD7
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Sets service image path in registry
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence