48121733fef902a5518568547973c827230367ade22c6fe762cdf3781b2087eb | Triage

Sharing

General

Target

URGENT_ QUOTATION_PDF.jar
Size

402KB
Sample

200713-f1l3cmleax
MD5

a6f6acd9307c87bf055f39ec4700d392
SHA1

54b9aac3c6420e37d29db4ab7d88524ffb82f21e
SHA256

48121733fef902a5518568547973c827230367ade22c6fe762cdf3781b2087eb
SHA512

ac5a9a1d8e0e56760c96e6c6c7dbdaac15df22b350cb552fd8f20cb639dc8e51717b4b39866ccd324c460e71b0639c5c7e45c7cbfb9c179b0d28fdb48cdd896c

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  URGENT_ QUOTATION_PDF.jar
- Size
  
  402KB
- MD5
  
  a6f6acd9307c87bf055f39ec4700d392
- SHA1
  
  54b9aac3c6420e37d29db4ab7d88524ffb82f21e
- SHA256
  
  48121733fef902a5518568547973c827230367ade22c6fe762cdf3781b2087eb
- SHA512
  
  ac5a9a1d8e0e56760c96e6c6c7dbdaac15df22b350cb552fd8f20cb639dc8e51717b4b39866ccd324c460e71b0639c5c7e45c7cbfb9c179b0d28fdb48cdd896c
Score

10^/10

persistence evasion trojan discovery
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Disables use of System Restore points
  evasion
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Adds Run entry to start application
  persistence
- Checks for installed software on the system
  discovery
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

Hidden Files and Directories

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistenceevasiontrojandiscovery

behavioral2

evasiontrojandiscoverypersistence