d38302058a8da53ce580ff94bccea0cac249f8b557b56bffdd97afc68969f4bd | Triage

Sharing

General

Target

d38302058a8da53ce580ff94bccea0cac249f8b557b56bffdd97afc68969f4bdN.exe
Size

92KB
Sample

241122-zaxs1syke1
MD5

cdaa3944e272eceb389536d9c36b5150
SHA1

35b6b45ed68b9ef228016681fbc2edadfde1f6ff
SHA256

d38302058a8da53ce580ff94bccea0cac249f8b557b56bffdd97afc68969f4bd
SHA512

9334a8e0e060bf1d33aa8b1fce8ae75ebadd4c3d52fb18ef50f301d2e394725d0a4dd2ede4f1e5a5da04fc5168a7031eebcddc097ac6f6e392f9496a1c38897c
SSDEEP

768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd7:41bC4Bk6lMTOWw4PkRAPos

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  d38302058a8da53ce580ff94bccea0cac249f8b557b56bffdd97afc68969f4bdN.exe
- Size
  
  92KB
- MD5
  
  cdaa3944e272eceb389536d9c36b5150
- SHA1
  
  35b6b45ed68b9ef228016681fbc2edadfde1f6ff
- SHA256
  
  d38302058a8da53ce580ff94bccea0cac249f8b557b56bffdd97afc68969f4bd
- SHA512
  
  9334a8e0e060bf1d33aa8b1fce8ae75ebadd4c3d52fb18ef50f301d2e394725d0a4dd2ede4f1e5a5da04fc5168a7031eebcddc097ac6f6e392f9496a1c38897c
- SSDEEP
  
  768:4zW4wnebSdDlmkok6lRGXu+jKZAOWjpiRHVAGr4PzpyRAJ7IwnDoSd7:41bC4Bk6lMTOWw4PkRAPos
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence