29337dc362bef95aa866aecf59784b6e91dc408fd8700dab52665afde4ee8476

Sharing

Copy URL Twitter E-mail

General

Target
The Whitehead Group NZ.txt
Size 111.7MB
Sample260722-gp2reawxdt
SHA256 29337dc362bef95aa866aecf59784b6e91dc408fd8700dab52665afde4ee8476
MD5 a1372487272a9b8a47539317544728d2
SHA1 dab042bc811834a677faaa9ea77b943b40f62437
SHA512 1ff3762d7a8a3b0e28fa21c8419f6bff66efa52bc3783027b9a9b54272262ca5649902dd87c82b08a69f261825ea5f6482e40adff630a6ac4cbeae8e715998eb
SSDEEP 24576:+8nE8VrJCT1NcPC4es44/ShGsNyC+KSiyMlOnf+phAUA5TgzoAzS0z7+4dKETX07:b
TLSH
T13348A63F09453A64AB3749E95A033621EEA82E77A06ED58930FDC1884FF3429F78D55C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  The Whitehead Group NZ.txt
- Size 111.7MB
- SHA256 29337dc362bef95aa866aecf59784b6e91dc408fd8700dab52665afde4ee8476
- MD5 a1372487272a9b8a47539317544728d2
- SHA1 dab042bc811834a677faaa9ea77b943b40f62437
- SHA512 1ff3762d7a8a3b0e28fa21c8419f6bff66efa52bc3783027b9a9b54272262ca5649902dd87c82b08a69f261825ea5f6482e40adff630a6ac4cbeae8e715998eb
- SSDEEP 24576:+8nE8VrJCT1NcPC4es44/ShGsNyC+KSiyMlOnf+phAUA5TgzoAzS0z7+4dKETX07:b
- TLSH
  T13348A63F09453A64AB3749E95A033621EEA82E77A06ED58930FDC1884FF3429F78D55C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10