f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214 | Triage

Resubmissions

13-01-2025 01:41

250113-b4f6csskhq 10

12-01-2025 23:10

250112-254wxswpen 10

12-01-2025 22:49

250112-2rs79stjbv 10

12-01-2025 21:15

250112-z39y2szkaz 10

12-01-2025 20:53

250112-zn9dzayndw 10

12-01-2025 20:52

250112-zn8sfayndt 10

12-01-2025 20:50

250112-zmy7lsymht 10

Sharing

General

Target

f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Size

136KB
Sample

250113-b4f6csskhq
MD5

bfb932c0c15243704cf27cb8c7eff520
SHA1

8c9e5e096e0f5855e435978b932d8ab63e859a29
SHA256

f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214
SHA512

b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5
SSDEEP

3072:3LVoDvPd+A4WhkhXDl+i1lApwH08TdpIIIIIIIIIIIIIIIII/IIIIIIIIIIIIII/:ZopGGgbiwU8JY

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
- Size
  
  136KB
- MD5
  
  bfb932c0c15243704cf27cb8c7eff520
- SHA1
  
  8c9e5e096e0f5855e435978b932d8ab63e859a29
- SHA256
  
  f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214
- SHA512
  
  b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5
- SSDEEP
  
  3072:3LVoDvPd+A4WhkhXDl+i1lApwH08TdpIIIIIIIIIIIIIIIII/IIIIIIIIIIIIII/:ZopGGgbiwU8JY
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence