a6f47784afd2c7f33c32639643e4535e249ca237414e5be7976e9b3045df3ffb | Triage

Sharing

General

Target

a6f47784afd2c7f33c32639643e4535e249ca237414e5be7976e9b3045df3ffb.img
Size

1.7MB
Sample

240921-bxt4msygmk
MD5

3857b1f84529b37f51f4e322d6dc6206
SHA1

d903ab341122495d66b07b874d8f95a489b12d5d
SHA256

a6f47784afd2c7f33c32639643e4535e249ca237414e5be7976e9b3045df3ffb
SHA512

09374858e905a8eebab36c6cb94c1646b80cb26358ea1ce559d2a0a1d058440ae1139654ed2dc2572c79344f8cb9579f29a03401cf9202543427cf86fc887c48
SSDEEP

49152:1U/FMktb3x+muH5i44fTco84Ws5zwgio:adMEb3x+mulIoh4H1i

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  Znkzcxi.exe
- Size
  
  1.7MB
- MD5
  
  be852e807a629c65f1b41617c8348f2c
- SHA1
  
  05d64861185f84e071d8c98eaf7ea86d22bd921d
- SHA256
  
  b1b74ff5c67cfdc16f1cb30db9b885046c4c5d71af575a2d3de4a79918c1ce89
- SHA512
  
  116f8da7c3c1bd69c3ff600348c35f4ad181f1c47a093d7224118c26c8d9ac03cba220dddb9d3fb7fdbf7aab52ff78fd9f064956007d6480ddb4d6ea38e6cea8
- SSDEEP
  
  49152:fU/FMktb3x+muH5i44fTco84Ws5zwgio:cdMEb3x+mulIoh4H1i
Score

10^/10

discovery persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence