4a702c33e4e15617b56f545a956aec37c92585217091c1e2ca08180380709b6b | Triage

Sharing

General

Target

4a702c33e4e15617b56f545a956aec37c92585217091c1e2ca08180380709b6b
Size

370KB
Sample

191025-sbsy82q9ja
MD5

d41740255bf565a5df7474e7fb36852e
SHA1

b550a2e02d25af4699e1cbf3ed35f2780c745489
SHA256

4a702c33e4e15617b56f545a956aec37c92585217091c1e2ca08180380709b6b
SHA512

3f12a5e25de3701f654569e416455b50313355345f4b5d69f2e5e6fe4abba3f0d058f65704058684988d1779b482e68919cacd43cf2e1fd372171e00e63bd708

Score

10^/10

Malware Config

Targets

- Target
  
  4a702c33e4e15617b56f545a956aec37c92585217091c1e2ca08180380709b6b
- Size
  
  370KB
- MD5
  
  d41740255bf565a5df7474e7fb36852e
- SHA1
  
  b550a2e02d25af4699e1cbf3ed35f2780c745489
- SHA256
  
  4a702c33e4e15617b56f545a956aec37c92585217091c1e2ca08180380709b6b
- SHA512
  
  3f12a5e25de3701f654569e416455b50313355345f4b5d69f2e5e6fe4abba3f0d058f65704058684988d1779b482e68919cacd43cf2e1fd372171e00e63bd708
Score

10^/10
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor name in registry (likely anti-VM)
- Program crash
- Windows security modification
  evasion trojan
- Modifies system certificate store
  evasion spyware trojan
- Checks system information in the registry (likely anti-VM)
- Modifies service
  persistence
task1 task2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

task1

task2