62239cd9bcc61bf8140d56401ee7ea2432958b1979a5219e05ae88c07936f170 | Triage

Sharing

General

Target

62239cd9bcc61bf8140d56401ee7ea2432958b1979a5219e05ae88c07936f170
Size

736KB
Sample

221002-1x73yacee9
MD5

3e99fd0c5ba73d275be7823a7cff8c71
SHA1

40ffa1f1819d439a000825f8f835be28a95c06b3
SHA256

62239cd9bcc61bf8140d56401ee7ea2432958b1979a5219e05ae88c07936f170
SHA512

2fe17547def2b6b7137b8c6129870f4d5a5dff1be4589a2b1b502c8a9d692cb0754175faf691e4f8b712663c40ab61911ec24f9016a06d779c3884ec16f3cee0
SSDEEP

3072:xzQeL7mgqygfor1sP7/PhPl0ZNyeeV2yqVq9wrRgaTLVn4cbnm8Mxdz7LEmwMgBL:ZqvP7PhODRgaNnH7m8NMh

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  62239cd9bcc61bf8140d56401ee7ea2432958b1979a5219e05ae88c07936f170
- Size
  
  736KB
- MD5
  
  3e99fd0c5ba73d275be7823a7cff8c71
- SHA1
  
  40ffa1f1819d439a000825f8f835be28a95c06b3
- SHA256
  
  62239cd9bcc61bf8140d56401ee7ea2432958b1979a5219e05ae88c07936f170
- SHA512
  
  2fe17547def2b6b7137b8c6129870f4d5a5dff1be4589a2b1b502c8a9d692cb0754175faf691e4f8b712663c40ab61911ec24f9016a06d779c3884ec16f3cee0
- SSDEEP
  
  3072:xzQeL7mgqygfor1sP7/PhPl0ZNyeeV2yqVq9wrRgaTLVn4cbnm8Mxdz7LEmwMgBL:ZqvP7PhODRgaNnH7m8NMh
Score

10^/10

evasion persistence trojan
- Modifies security service
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan