从Kimsuky组织msc攻击样本到GrimResource

2024-09-14 Aliyun From Kimsuky MSC attack samples to GrimResource

https://xz.aliyun.com/t/15618

Thumbnail for 从Kimsuky组织msc攻击样本到GrimResource

The source analyzes a Kimsuky MSC attack sample and explains how malicious Microsoft Management Console files can be abused for code execution and defense evasion. It references the GrimResource technique while noting that this sample uses a different attack approach from the original APDS-based method. The report includes sample hash evidence and focuses on MSC file structure and execution behavior relevant to Windows intrusion triage.

Indicators of Compromise

Type Value First Seen Last Seen
HASH 57e9b7d1c18684a4e8b3688c454e832… 2024-09-14 2024-11-22
URL https://petssecondchance.larcit… 2024-09-14 2024-11-22
URL https://petssecondchance.larcit… 2024-09-13 2024-11-22
URL https://petssecondchance.larcit… 2024-09-13 2024-11-22
URL https://petssecondchance.larcit… 2024-09-13 2024-11-22
DOMAIN petssecondchance.larcity.dev 2024-09-13 2024-11-22

Related Actors

Related Reports

« Back