5c058a8be323a11408cca333ffa5359659c3c0dd2c7d6dd83a7f8a206355f3c2 | Triage

Sharing

General

Target

05C665B2A34C8011E275AB40B3E26E7F.zip
Size

900KB
Sample

250117-znpdssspas
MD5

1d5e6e599ab53047f50a2bf5da1e94ea
SHA1

8c713f3afe46f6aa19228e28257a94690eba4bd2
SHA256

5c058a8be323a11408cca333ffa5359659c3c0dd2c7d6dd83a7f8a206355f3c2
SHA512

3ff26d92e3ea7d9b56a3b83a5a2c76d376bb4dd6e33a21337b7075161b90bb61c0c993ad6aa68f50ce9e10bc5749e7195f89e17e045da04718edeac20fb26a3b
SSDEEP

24576:1DR1NP3eZF8JD2VrOlVtqgK8Mhjq2OQWvr+vUV93:9RveZF8JyUVoV8MhOb3Z

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  05C665B2A34C8011E275AB40B3E26E7F
- Size
  
  903KB
- MD5
  
  05c665b2a34c8011e275ab40b3e26e7f
- SHA1
  
  080a29cf40766c2a9ad84ee238aebe8096ea2ef1
- SHA256
  
  ed1b7db008a31d99560f934344dbea4aa1ac94979a0578a4c39856d24598b472
- SHA512
  
  ff505825f62555dbac72f486f3c12c36c300843b6feb82a58fa42aeedc868af1f70e518e3bd75faba44b0846f6d2e72c0cf0ae874d3652b6b3f6bd37a43861d8
- SSDEEP
  
  24576:5cW9nP4TMlVH80VNmkSwWp1C68FaQtpg:5cGwTMlVH8GmkZQC2E
Score

10^/10

discovery persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence