a61a3a202f45693bf7e21310198718e952dba27e6430f8c035a58be1f9276120 | Triage

Submit
Reports

Overview

overview

Static

static

5

a61a3a202f...20.exe

windows7-x64

a61a3a202f...20.exe

windows10-2004-x64

Sharing

General

Target

a61a3a202f45693bf7e21310198718e952dba27e6430f8c035a58be1f9276120
Size

5.0MB
Sample

221102-ylvblabdc9
MD5

3fc57fd38dd0521976ea9c0f37c187dc
SHA1

f5610c292278e8dd75decdf238dc630f91d204a9
SHA256

a61a3a202f45693bf7e21310198718e952dba27e6430f8c035a58be1f9276120
SHA512

c4b8055d6dca7a969b7096ea7cb04db872bfa3addc0aece41f5fc62c33ae6e1982dfa6e71e0f373456cf89b2f99ff2dee947bb62ba612126c0e86a49146b1300
SSDEEP

98304:EstZLNLdQRhpII22cNb3g2n8zMkd6tSYFxrkDB4n:5ZUhH22cNb3Z8Qkd6tSgJkD

Score

10^/10

discovery evasion exploit persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a61a3a202f45693bf7e21310198718e952dba27e6430f8c035a58be1f9276120.exe

Resource

win7-20220812-en

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

a61a3a202f45693bf7e21310198718e952dba27e6430f8c035a58be1f9276120.exe

Resource

win10v2004-20220901-en

discovery evasion exploit persistence trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  a61a3a202f45693bf7e21310198718e952dba27e6430f8c035a58be1f9276120
- Size
  
  5.0MB
- MD5
  
  3fc57fd38dd0521976ea9c0f37c187dc
- SHA1
  
  f5610c292278e8dd75decdf238dc630f91d204a9
- SHA256
  
  a61a3a202f45693bf7e21310198718e952dba27e6430f8c035a58be1f9276120
- SHA512
  
  c4b8055d6dca7a969b7096ea7cb04db872bfa3addc0aece41f5fc62c33ae6e1982dfa6e71e0f373456cf89b2f99ff2dee947bb62ba612126c0e86a49146b1300
- SSDEEP
  
  98304:EstZLNLdQRhpII22cNb3g2n8zMkd6tSYFxrkDB4n:5ZUhH22cNb3Z8Qkd6tSgJkD
Score

10^/10

evasion trojan discovery exploit persistence
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasionexploitpersistencetrojan

© 2018-2024

Terms | Privacy