eaff210dc351a3eac0c5b60b748e396a80018af676cdee58e9147d9e4ddcba92 | Triage

Sharing

General

Target

eaff210dc351a3eac0c5b60b748e396a80018af676cdee58e9147d9e4ddcba92N.exe
Size

92KB
Sample

241122-lqwc8strhj
MD5

752a0b32f10a8ee9afe70499e2f47480
SHA1

6c26e4aa292dd9a2bff48685ce15c99e4423d894
SHA256

eaff210dc351a3eac0c5b60b748e396a80018af676cdee58e9147d9e4ddcba92
SHA512

5494eb024bd199fbc7952f9851acdab3ee98ce2877ff7bb6c6b2e1bee06a98967e1d0dea379b5a959545f42892f29b8b4975afe8beefe85cc1684aa9728a4e13
SSDEEP

768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdd:41bC4Bk6lMTOWw4PkRAPoo

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  eaff210dc351a3eac0c5b60b748e396a80018af676cdee58e9147d9e4ddcba92N.exe
- Size
  
  92KB
- MD5
  
  752a0b32f10a8ee9afe70499e2f47480
- SHA1
  
  6c26e4aa292dd9a2bff48685ce15c99e4423d894
- SHA256
  
  eaff210dc351a3eac0c5b60b748e396a80018af676cdee58e9147d9e4ddcba92
- SHA512
  
  5494eb024bd199fbc7952f9851acdab3ee98ce2877ff7bb6c6b2e1bee06a98967e1d0dea379b5a959545f42892f29b8b4975afe8beefe85cc1684aa9728a4e13
- SSDEEP
  
  768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSdd:41bC4Bk6lMTOWw4PkRAPoo
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence