b30acefcdf5ba41a18270ae8e79dd9ddb445a729ff67aade0abf3259592738ed | Triage

Sharing

General

Target

b30acefcdf5ba41a18270ae8e79dd9ddb445a729ff67aade0abf3259592738ed.exe
Size

5.4MB
Sample

240925-ctn9nazalj
MD5

48d39ee98dc831d41f504bfd5b27ef3d
SHA1

93bd6537bc75914e0a88ee0d8c07dda432998cf4
SHA256

b30acefcdf5ba41a18270ae8e79dd9ddb445a729ff67aade0abf3259592738ed
SHA512

eb1d94a8cd36bd739905c2f20b67eb80101e11351eb9b47c1891de99304634f69e8bb8d46e118566a2cb2f9860b9811c9984c19c1dfec8018eebe7da806ac4d6
SSDEEP

49152:3Dex5xKkEJkGYYpT0+TFiH7efP0x58IJL+md3rHgDNMKLo8SsxG/XcW32gqkAfoO:F4s6efPQ53JLbd3LINMLaGUW39f0

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  b30acefcdf5ba41a18270ae8e79dd9ddb445a729ff67aade0abf3259592738ed.exe
- Size
  
  5.4MB
- MD5
  
  48d39ee98dc831d41f504bfd5b27ef3d
- SHA1
  
  93bd6537bc75914e0a88ee0d8c07dda432998cf4
- SHA256
  
  b30acefcdf5ba41a18270ae8e79dd9ddb445a729ff67aade0abf3259592738ed
- SHA512
  
  eb1d94a8cd36bd739905c2f20b67eb80101e11351eb9b47c1891de99304634f69e8bb8d46e118566a2cb2f9860b9811c9984c19c1dfec8018eebe7da806ac4d6
- SSDEEP
  
  49152:3Dex5xKkEJkGYYpT0+TFiH7efP0x58IJL+md3rHgDNMKLo8SsxG/XcW32gqkAfoO:F4s6efPQ53JLbd3LINMLaGUW39f0
Score

8^/10

discovery persistence privilege_escalation
- Sets service image path in registry
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Authentication Package

Registry Run Keys / Startup Folder

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Boot or Logon Autostart Execution

Authentication Package

Registry Run Keys / Startup Folder

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation