4467eb64c7565778b346e66c1f6f9ff6d25cd910172817d1dbc183c2b93227ca | Triage

Sharing

General

Target

4467eb64c7565778b346e66c1f6f9ff6d25cd910172817d1dbc183c2b93227ca
Size

1.3MB
Sample

221007-n5pv4scda8
MD5

ebb38c489998a898e39bb6a95ac2856e
SHA1

b6c66ecb6fff21218a13d076a78b215406b94293
SHA256

4467eb64c7565778b346e66c1f6f9ff6d25cd910172817d1dbc183c2b93227ca
SHA512

506cfe7e7f891924563fd174695dc8513dba6a9174f0d150defad26428349e67b555f7cee24daac225a285c5b368db3b4ba1998906297c55a42b96f3185adf80
SSDEEP

24576:uL1EoK804IflP6CGaDI2jt4VwQtk+CsNFoDyObMfcQz9dTwHO742l2DXeAWH:0qod0/dJGaJt4fmSeDyObYfTwu1l1

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  4467eb64c7565778b346e66c1f6f9ff6d25cd910172817d1dbc183c2b93227ca
- Size
  
  1.3MB
- MD5
  
  ebb38c489998a898e39bb6a95ac2856e
- SHA1
  
  b6c66ecb6fff21218a13d076a78b215406b94293
- SHA256
  
  4467eb64c7565778b346e66c1f6f9ff6d25cd910172817d1dbc183c2b93227ca
- SHA512
  
  506cfe7e7f891924563fd174695dc8513dba6a9174f0d150defad26428349e67b555f7cee24daac225a285c5b368db3b4ba1998906297c55a42b96f3185adf80
- SSDEEP
  
  24576:uL1EoK804IflP6CGaDI2jt4VwQtk+CsNFoDyObMfcQz9dTwHO742l2DXeAWH:0qod0/dJGaJt4fmSeDyObYfTwu1l1
Score

10^/10

evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Bypass User Account Control

Scheduled Task

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2