e8aadfaa77386b77af2c3f84003ab8635a8dfcfa6f6308d3cd3a2eb751b9128e | Triage

Sharing

General

Target

e8aadfaa77386b77af2c3f84003ab8635a8dfcfa6f6308d3cd3a2eb751b9128e.exe
Size

92KB
Sample

241119-q4s79awglf
MD5

78bc6ec72fd808d378c7158b80e1c285
SHA1

888f7b0a24e345644d8a07e7e74c5104d057c9c6
SHA256

e8aadfaa77386b77af2c3f84003ab8635a8dfcfa6f6308d3cd3a2eb751b9128e
SHA512

3f4133d5ebf72b1c7dd0bd0496b86a59ca12119f7be39d7d1a1b547325af5457b9c06c21d2c8bd0b936de730ef34e6696f7d0fcc26532c54f60ad8b2c2483ed9
SSDEEP

768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd5:41bC4Bk6lMTOWw4PkRAPoe

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  e8aadfaa77386b77af2c3f84003ab8635a8dfcfa6f6308d3cd3a2eb751b9128e.exe
- Size
  
  92KB
- MD5
  
  78bc6ec72fd808d378c7158b80e1c285
- SHA1
  
  888f7b0a24e345644d8a07e7e74c5104d057c9c6
- SHA256
  
  e8aadfaa77386b77af2c3f84003ab8635a8dfcfa6f6308d3cd3a2eb751b9128e
- SHA512
  
  3f4133d5ebf72b1c7dd0bd0496b86a59ca12119f7be39d7d1a1b547325af5457b9c06c21d2c8bd0b936de730ef34e6696f7d0fcc26532c54f60ad8b2c2483ed9
- SSDEEP
  
  768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd5:41bC4Bk6lMTOWw4PkRAPoe
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence