6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48 | Triage

Sharing

General

Target

6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48
Size

556KB
Sample

221020-mysgzsafa4
MD5

900f7a4067193e3e4a395c6fa63f7b00
SHA1

8f8d440880e73495c9cb3ffbf37c61e7a00aaaf1
SHA256

6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48
SHA512

e14b65ac150a99c57e57c36f82dcc5349c6f0da23b6291d7dbbc0448ca3904f2818b8916320424aa7c01e3e1421cef5ab75a37f54faaf2c398408a4a9d4576c8
SSDEEP

12288:qmfGGuZBppS/EK/+7eAUxOpanp/iBfAL9rBgBbkxpTs1/fH1almP:qmfGGyfMVW7pUxjnp/p9OFkLe/gl

Score

8^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48
- Size
  
  556KB
- MD5
  
  900f7a4067193e3e4a395c6fa63f7b00
- SHA1
  
  8f8d440880e73495c9cb3ffbf37c61e7a00aaaf1
- SHA256
  
  6f76182562cc3ab7ba890aadac33422c2a4aaabd9b2e11e1c59efeade4c49e48
- SHA512
  
  e14b65ac150a99c57e57c36f82dcc5349c6f0da23b6291d7dbbc0448ca3904f2818b8916320424aa7c01e3e1421cef5ab75a37f54faaf2c398408a4a9d4576c8
- SSDEEP
  
  12288:qmfGGuZBppS/EK/+7eAUxOpanp/iBfAL9rBgBbkxpTs1/fH1almP:qmfGGyfMVW7pUxjnp/p9OFkLe/gl
Score

8^/10

discovery evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2