General

  • Target

    1ed1eb1810245e54c8ffd661586eda88a3b60a38ce4d89226b908b449f253b45N.exe

  • Size

    70KB

  • Sample

    241114-frs2lsvfjp

  • MD5

    aee588bdee693312cfbd63937316cd80

  • SHA1

    90a4780d01c98eae611e54bb0adb17d34d56640d

  • SHA256

    1ed1eb1810245e54c8ffd661586eda88a3b60a38ce4d89226b908b449f253b45

  • SHA512

    f7df19e3e5b837b4cef9a83a34eefa8982cd965c0243b69a7702e506b4d7e16b15a7f5567fb9867cee0d415fb32aad0f0c28eda637bf3ed5bdc1764c2b8f5be6

  • SSDEEP

    1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw860:Olg35GTslA5t3/w8x

Malware Config

Targets

    • Target

      1ed1eb1810245e54c8ffd661586eda88a3b60a38ce4d89226b908b449f253b45N.exe

    • Size

      70KB

    • MD5

      aee588bdee693312cfbd63937316cd80

    • SHA1

      90a4780d01c98eae611e54bb0adb17d34d56640d

    • SHA256

      1ed1eb1810245e54c8ffd661586eda88a3b60a38ce4d89226b908b449f253b45

    • SHA512

      f7df19e3e5b837b4cef9a83a34eefa8982cd965c0243b69a7702e506b4d7e16b15a7f5567fb9867cee0d415fb32aad0f0c28eda637bf3ed5bdc1764c2b8f5be6

    • SSDEEP

      1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw860:Olg35GTslA5t3/w8x

    • Windows security bypass

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Event Triggered Execution: Image File Execution Options Injection

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Indicator Removal: Clear Persistence

      remove IFEO.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks