62b242a5ef86af246a4adf75e050dd46b984c64ff3e0ad7d9b609cb2bc325bfe | Triage

Sharing

General

Target

62b242a5ef86af246a4adf75e050dd46b984c64ff3e0ad7d9b609cb2bc325bfe.exe
Size

92KB
Sample

241121-k7elda1jes
MD5

4d0ff662db3c28bdefae42d1f46e28fe
SHA1

18a0c14eac56a83564f9a2ad0fe68e759f72ac7e
SHA256

62b242a5ef86af246a4adf75e050dd46b984c64ff3e0ad7d9b609cb2bc325bfe
SHA512

b91410d864c12d09b8680f1e352bfffb47489bfa92691ef35618e27f98e60b2f50692992dc640a69998b164626ed5c196afbcbde4390fb938a4406b4c7532126
SSDEEP

768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd5:41bC4Bk6lMTOWw4PkRAPoI

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  62b242a5ef86af246a4adf75e050dd46b984c64ff3e0ad7d9b609cb2bc325bfe.exe
- Size
  
  92KB
- MD5
  
  4d0ff662db3c28bdefae42d1f46e28fe
- SHA1
  
  18a0c14eac56a83564f9a2ad0fe68e759f72ac7e
- SHA256
  
  62b242a5ef86af246a4adf75e050dd46b984c64ff3e0ad7d9b609cb2bc325bfe
- SHA512
  
  b91410d864c12d09b8680f1e352bfffb47489bfa92691ef35618e27f98e60b2f50692992dc640a69998b164626ed5c196afbcbde4390fb938a4406b4c7532126
- SSDEEP
  
  768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd5:41bC4Bk6lMTOWw4PkRAPoI
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence