32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119 | Triage

Sharing

General

Target

32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119
Size

31KB
Sample

220919-hvrdashdaq
MD5

e974382a9c48f021c708e09c73f34dc0
SHA1

0b63fc473955b58407191b1d5110b4f85acf839b
SHA256

32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119
SHA512

f2850c4aa85213ae6205cb8884c554b63b6f7cfdd1c24c680563fac9b62545a92e121319bfee209307aa9a5ed39f69f4dd9326c25aee29c0126354d1950eeba2
SSDEEP

768:n0jzwKwkKMtykxLqJgt8tBlnbcuyD7UzNWGj:nlEKZ3G8pnouy85R

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119
- Size
  
  31KB
- MD5
  
  e974382a9c48f021c708e09c73f34dc0
- SHA1
  
  0b63fc473955b58407191b1d5110b4f85acf839b
- SHA256
  
  32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119
- SHA512
  
  f2850c4aa85213ae6205cb8884c554b63b6f7cfdd1c24c680563fac9b62545a92e121319bfee209307aa9a5ed39f69f4dd9326c25aee29c0126354d1950eeba2
- SSDEEP
  
  768:n0jzwKwkKMtykxLqJgt8tBlnbcuyD7UzNWGj:nlEKZ3G8pnouy85R
Score

10^/10

evasion persistence trojan
- UAC bypass
  evasion trojan
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2