a27e62c716fd3e19d53fe27c25a3238d805fecc13375b46c67409eabc0c7275e | Triage

Sharing

General

Target

a27e62c716fd3e19d53fe27c25a3238d805fecc13375b46c67409eabc0c7275e
Size

1.0MB
Sample

220919-mswbpahcbn
MD5

79e37b464938e19ec450f2408bf5dd07
SHA1

11caa525e5a5061a4e6b5b86006601c784b6a95f
SHA256

a27e62c716fd3e19d53fe27c25a3238d805fecc13375b46c67409eabc0c7275e
SHA512

fc00ca78ee6d6aeb7f259f0a854008057d50c1682adddb624ef56a6a770fc5657576b6d801260db7a3e4fc2247de64202baea4ab9a8c509bc696c32f55c55a30
SSDEEP

24576:wT+XEHz48vLwhrAdKu0Gr1yDJXvKoxuecF3C58ospiEwV5wXC:wTn8kdK7amZKwuPF3wFHwy

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  a27e62c716fd3e19d53fe27c25a3238d805fecc13375b46c67409eabc0c7275e
- Size
  
  1.0MB
- MD5
  
  79e37b464938e19ec450f2408bf5dd07
- SHA1
  
  11caa525e5a5061a4e6b5b86006601c784b6a95f
- SHA256
  
  a27e62c716fd3e19d53fe27c25a3238d805fecc13375b46c67409eabc0c7275e
- SHA512
  
  fc00ca78ee6d6aeb7f259f0a854008057d50c1682adddb624ef56a6a770fc5657576b6d801260db7a3e4fc2247de64202baea4ab9a8c509bc696c32f55c55a30
- SSDEEP
  
  24576:wT+XEHz48vLwhrAdKu0Gr1yDJXvKoxuecF3C58ospiEwV5wXC:wTn8kdK7amZKwuPF3wFHwy
Score

10^/10

evasion trojan persistence
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistencetrojan