General

  • Target

    b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a

  • Size

    45KB

  • Sample

    241114-cak3wssgnd

  • MD5

    0a142a0cffb5b0344435446f1a3600ee

  • SHA1

    ab322c5329c3eeef1d71c2568ce4662215a15255

  • SHA256

    b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a

  • SHA512

    2dd422c56ccf87cb12c3a6a4f049e149c69d216f730b154a32bec17485eb1a4632ad3a46866fd09548b4b6085112fe43ab8827ebf74b845815769d06ce032b5c

  • SSDEEP

    768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvRWrE5g6:RUNHFKQbIkHvGkAzmg6

Malware Config

Targets

    • Target

      b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a

    • Size

      45KB

    • MD5

      0a142a0cffb5b0344435446f1a3600ee

    • SHA1

      ab322c5329c3eeef1d71c2568ce4662215a15255

    • SHA256

      b5cc09af42e799ac1e06b63295af65ec041ca8820cc9db2a2c2c955be44d802a

    • SHA512

      2dd422c56ccf87cb12c3a6a4f049e149c69d216f730b154a32bec17485eb1a4632ad3a46866fd09548b4b6085112fe43ab8827ebf74b845815769d06ce032b5c

    • SSDEEP

      768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvRWrE5g6:RUNHFKQbIkHvGkAzmg6

    • Windows security bypass

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops file in Drivers directory

    • Event Triggered Execution: Image File Execution Options Injection

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Indicator Removal: Clear Persistence

      remove IFEO.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks