9e904d303ed7a7ec9be68242030049d2639799b19a19246d82daf114890f36fd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9e904d303ed7a7ec9be68242030049d2639799b19a19246d82daf114890f36fdN
Size

163KB
Sample

241003-ja64pa1hjj
MD5

f89a9c91b35673d634cadd68048705b0
SHA1

ba2a5750fef67b9d772d65c4eba5a4072b80abdd
SHA256

9e904d303ed7a7ec9be68242030049d2639799b19a19246d82daf114890f36fd
SHA512

5bfa63b849d547ae024770c8a4693155eed70500a831472d84550b894d93537d436f661604fa83c0412cf7db2243385c174c8bba7d833560b30356baceacaf1d
SSDEEP

3072:F3qHYCVBK1vtbYA6neZf2fLURkaGyhrqTrBecu7:lqHYCyLl6neZufLUGyhrqnBrI

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  9e904d303ed7a7ec9be68242030049d2639799b19a19246d82daf114890f36fdN
- Size
  
  163KB
- MD5
  
  f89a9c91b35673d634cadd68048705b0
- SHA1
  
  ba2a5750fef67b9d772d65c4eba5a4072b80abdd
- SHA256
  
  9e904d303ed7a7ec9be68242030049d2639799b19a19246d82daf114890f36fd
- SHA512
  
  5bfa63b849d547ae024770c8a4693155eed70500a831472d84550b894d93537d436f661604fa83c0412cf7db2243385c174c8bba7d833560b30356baceacaf1d
- SSDEEP
  
  3072:F3qHYCVBK1vtbYA6neZf2fLURkaGyhrqTrBecu7:lqHYCyLl6neZufLUGyhrqnBrI
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence