11327883687a400e0ff1e3b8c5f6c11f3856fafc220a557755f12b5b213173d0 | Triage

Sharing

General

Target

11327883687a400e0ff1e3b8c5f6c11f3856fafc220a557755f12b5b213173d0
Size

240KB
Sample

220604-j29c5aafbq
MD5

ef3b43fa75c524ea9250ed56d75873a0
SHA1

8f43b5b5255fb929945ea4472abdde1a5048bcca
SHA256

11327883687a400e0ff1e3b8c5f6c11f3856fafc220a557755f12b5b213173d0
SHA512

ae0b645c21a685fe99ce4ad0230b4b47439bd777e7b7492011942c389992e3972f480f1c4d939e19003ec4e5c226e72d2df20c332bd8d26934ae3bb8a301ec84

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  11327883687a400e0ff1e3b8c5f6c11f3856fafc220a557755f12b5b213173d0
- Size
  
  240KB
- MD5
  
  ef3b43fa75c524ea9250ed56d75873a0
- SHA1
  
  8f43b5b5255fb929945ea4472abdde1a5048bcca
- SHA256
  
  11327883687a400e0ff1e3b8c5f6c11f3856fafc220a557755f12b5b213173d0
- SHA512
  
  ae0b645c21a685fe99ce4ad0230b4b47439bd777e7b7492011942c389992e3972f480f1c4d939e19003ec4e5c226e72d2df20c332bd8d26934ae3bb8a301ec84
Score

10^/10

evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Disabling Security Tools

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2