fbdfad1e5ae86e1f3fe7b80a3a18c1b6ec03542f2c6c59f22fc854ab6f0d0b1b | Triage

Sharing

General

Target

fbdfad1e5ae86e1f3fe7b80a3a18c1b6ec03542f2c6c59f22fc854ab6f0d0b1bN
Size

406KB
Sample

240920-wfnkrayhja
MD5

dff16c30f8ea8fb2b7b94c04397dd710
SHA1

2abf9596239423bf678b4e97215ee7d68e84d7a2
SHA256

fbdfad1e5ae86e1f3fe7b80a3a18c1b6ec03542f2c6c59f22fc854ab6f0d0b1b
SHA512

3634238724e97372f64df0e2904b1f8d624c756b52696fae055949ab8baa26a620a9d84864050b4149e0c2a7ffc6d09d8e5e45a32cd6df6002aa4ad0c2993b92
SSDEEP

6144:+f6gWITDEKX5U5TXH5U5Xj83XH5U1XH5U5Xj8s5DXH5U5qXH5XXH5U5oXH:GWAIKG53Ma3M3MvD3Mq3B3Mo3

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  fbdfad1e5ae86e1f3fe7b80a3a18c1b6ec03542f2c6c59f22fc854ab6f0d0b1bN
- Size
  
  406KB
- MD5
  
  dff16c30f8ea8fb2b7b94c04397dd710
- SHA1
  
  2abf9596239423bf678b4e97215ee7d68e84d7a2
- SHA256
  
  fbdfad1e5ae86e1f3fe7b80a3a18c1b6ec03542f2c6c59f22fc854ab6f0d0b1b
- SHA512
  
  3634238724e97372f64df0e2904b1f8d624c756b52696fae055949ab8baa26a620a9d84864050b4149e0c2a7ffc6d09d8e5e45a32cd6df6002aa4ad0c2993b92
- SSDEEP
  
  6144:+f6gWITDEKX5U5TXH5U5Xj83XH5U1XH5U5Xj8s5DXH5U5qXH5XXH5U5oXH:GWAIKG53Ma3M3MvD3Mq3B3Mo3
Score

10^/10

discovery persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence