0d97860747a11afe7b8298631eef715c9aca7c0b8d94346ea1a3d9d47533219f | Triage

Sharing

General

Target

0d97860747a11afe7b8298631eef715c9aca7c0b8d94346ea1a3d9d47533219fN.exe
Size

92KB
Sample

241122-h2ctgsslfq
MD5

bf557cf4acd17585e7b3e870dbc7aa50
SHA1

151ba331796892bfe83df832c5bac839b9acb9b8
SHA256

0d97860747a11afe7b8298631eef715c9aca7c0b8d94346ea1a3d9d47533219f
SHA512

3fcf2356be5c473e932260043cfb8f43d46eeb2ba16869ac97b4d4fc3c69c7448a2eff5bf0f3b94bb04130a79d8b4b1c267ce495339eed2e171fffbf23ba0e92
SSDEEP

768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd1:41bC4Bk6lMTOWw4PkRAPoA

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  0d97860747a11afe7b8298631eef715c9aca7c0b8d94346ea1a3d9d47533219fN.exe
- Size
  
  92KB
- MD5
  
  bf557cf4acd17585e7b3e870dbc7aa50
- SHA1
  
  151ba331796892bfe83df832c5bac839b9acb9b8
- SHA256
  
  0d97860747a11afe7b8298631eef715c9aca7c0b8d94346ea1a3d9d47533219f
- SHA512
  
  3fcf2356be5c473e932260043cfb8f43d46eeb2ba16869ac97b4d4fc3c69c7448a2eff5bf0f3b94bb04130a79d8b4b1c267ce495339eed2e171fffbf23ba0e92
- SSDEEP
  
  768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd1:41bC4Bk6lMTOWw4PkRAPoA
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence