8ca8d5951d9499acc24c0b0f58c9128b7dc9f08ee203ea3a58929cda7af0b5b7 | Triage

Sharing

General

Target

8ca8d5951d9499acc24c0b0f58c9128b7dc9f08ee203ea3a58929cda7af0b5b7.exe
Size

27.3MB
Sample

250222-e7yflaymen
MD5

6eb2a56795b1e60bcfa4dedf4d9bedd0
SHA1

5201369f8de3135dddc238df8a6fb1b514e397a0
SHA256

8ca8d5951d9499acc24c0b0f58c9128b7dc9f08ee203ea3a58929cda7af0b5b7
SHA512

f6ef9198dad57de58f66c80a3b235a053aa106c49ba668cf70fa9c2d7d7c95bcfe654cf76bdccc83e492ebf3cdfcf40a610ce4b66e1905bc4ac28794201e63f2
SSDEEP

786432:1HY/HBEXbSmnfRQ2P9/8pkaEQWoYcQn43:14/hELSmnfmmR8CQxYcQc

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  8ca8d5951d9499acc24c0b0f58c9128b7dc9f08ee203ea3a58929cda7af0b5b7.exe
- Size
  
  27.3MB
- MD5
  
  6eb2a56795b1e60bcfa4dedf4d9bedd0
- SHA1
  
  5201369f8de3135dddc238df8a6fb1b514e397a0
- SHA256
  
  8ca8d5951d9499acc24c0b0f58c9128b7dc9f08ee203ea3a58929cda7af0b5b7
- SHA512
  
  f6ef9198dad57de58f66c80a3b235a053aa106c49ba668cf70fa9c2d7d7c95bcfe654cf76bdccc83e492ebf3cdfcf40a610ce4b66e1905bc4ac28794201e63f2
- SSDEEP
  
  786432:1HY/HBEXbSmnfRQ2P9/8pkaEQWoYcQn43:14/hELSmnfmmR8CQxYcQc
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryexecution