644cec7ae7efa1afa3d8ea470a542dfeb4a73bd0bb6488bdf6ef544e26bd6960 | Triage

Sharing

General

Target

644cec7ae7efa1afa3d8ea470a542dfeb4a73bd0bb6488bdf6ef544e26bd6960
Size

432KB
Sample

221107-pwk18sadbj
MD5

08c19f872d8b11281c64ba5d8aa7f910
SHA1

efaa4d5d65a0872e491972f733774e999b3f5903
SHA256

644cec7ae7efa1afa3d8ea470a542dfeb4a73bd0bb6488bdf6ef544e26bd6960
SHA512

db3bb4a3fa4e0bb5c40bf85d9faadf3ebe6563e4a982f4cec103edc6dd8680bd31b34b46e2c77fcd90b81478e449d93a922059a38820aa06c859e7de826cf7e3
SSDEEP

12288:lzCGrA9sEK7N/wGhn7Z6qGtmGLfflQfTVsXD:RteK7xwGh7ZsUGLfNQO

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  644cec7ae7efa1afa3d8ea470a542dfeb4a73bd0bb6488bdf6ef544e26bd6960
- Size
  
  432KB
- MD5
  
  08c19f872d8b11281c64ba5d8aa7f910
- SHA1
  
  efaa4d5d65a0872e491972f733774e999b3f5903
- SHA256
  
  644cec7ae7efa1afa3d8ea470a542dfeb4a73bd0bb6488bdf6ef544e26bd6960
- SHA512
  
  db3bb4a3fa4e0bb5c40bf85d9faadf3ebe6563e4a982f4cec103edc6dd8680bd31b34b46e2c77fcd90b81478e449d93a922059a38820aa06c859e7de826cf7e3
- SSDEEP
  
  12288:lzCGrA9sEK7N/wGhn7Z6qGtmGLfflQfTVsXD:RteK7xwGh7ZsUGLfNQO
Score

10^/10

evasion persistence trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables taskbar notifications via registry modification
  evasion
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2