b5e0c038f3f6f225b402354a607411cf0e41317c4dda0f85f67a591ecc2d48d7 | Triage

Sharing

General

Target

f4ec5e3d1c8ba823ffe99a85704db2de.exe
Size

379KB
Sample

241002-sczxtswdlc
MD5

f4ec5e3d1c8ba823ffe99a85704db2de
SHA1

beab1d4c708e247acb025da51e8af82bd2c0cebe
SHA256

b5e0c038f3f6f225b402354a607411cf0e41317c4dda0f85f67a591ecc2d48d7
SHA512

b6194b6e9ce21019ddd82431050ef4b9fd91501f6a603e8fb6ea12ae5dfb7e7a70b712c01857ebbbf8704c70babd581c6f9d905382f382608131a5d5a8fe454e
SSDEEP

384:H+b0ZIrceK5eDKe5Teuek41UQFn0FWkorqVsiEsbTGETNkrMX4mT6h8CfskRpwKH:RZRiKFnQoWTxgPC3Yi3iPmbLDC

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  f4ec5e3d1c8ba823ffe99a85704db2de.exe
- Size
  
  379KB
- MD5
  
  f4ec5e3d1c8ba823ffe99a85704db2de
- SHA1
  
  beab1d4c708e247acb025da51e8af82bd2c0cebe
- SHA256
  
  b5e0c038f3f6f225b402354a607411cf0e41317c4dda0f85f67a591ecc2d48d7
- SHA512
  
  b6194b6e9ce21019ddd82431050ef4b9fd91501f6a603e8fb6ea12ae5dfb7e7a70b712c01857ebbbf8704c70babd581c6f9d905382f382608131a5d5a8fe454e
- SSDEEP
  
  384:H+b0ZIrceK5eDKe5Teuek41UQFn0FWkorqVsiEsbTGETNkrMX4mT6h8CfskRpwKH:RZRiKFnQoWTxgPC3Yi3iPmbLDC
Score

10^/10

discovery persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence