6371ee0e1d720edfd6451a102c5c9a72af03fe2b23f1dc7003d88909770c5d44 | Triage

Sharing

General

Target

6371ee0e1d720edfd6451a102c5c9a72af03fe2b23f1dc7003d88909770c5d44
Size

163KB
Sample

221123-mq85rsaa3z
MD5

67a2df021fa751987b0fb7d93a74bc93
SHA1

d91c8dfef6162d18d9e2ff0cd069f0a505f26434
SHA256

6371ee0e1d720edfd6451a102c5c9a72af03fe2b23f1dc7003d88909770c5d44
SHA512

997f4dfb5a8e12daa21586fb3267a9fe4c702538e322c7855cd83c1680bd60b057b3c55b6d8e677ba13ee2461e9c8b59039cb8e4a302853b6e61fc4088070e10
SSDEEP

3072:dqhMPsVMYjUtQl78voutbzoI7h+aS1Gnf:dqhMPsFjU2F8voSbzo0naGf

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  6371ee0e1d720edfd6451a102c5c9a72af03fe2b23f1dc7003d88909770c5d44
- Size
  
  163KB
- MD5
  
  67a2df021fa751987b0fb7d93a74bc93
- SHA1
  
  d91c8dfef6162d18d9e2ff0cd069f0a505f26434
- SHA256
  
  6371ee0e1d720edfd6451a102c5c9a72af03fe2b23f1dc7003d88909770c5d44
- SHA512
  
  997f4dfb5a8e12daa21586fb3267a9fe4c702538e322c7855cd83c1680bd60b057b3c55b6d8e677ba13ee2461e9c8b59039cb8e4a302853b6e61fc4088070e10
- SSDEEP
  
  3072:dqhMPsVMYjUtQl78voutbzoI7h+aS1Gnf:dqhMPsFjU2F8voSbzo0naGf
Score

10^/10

evasion persistence trojan
- Modifies WinLogon for persistence
  persistence
- Modifies system executable filetype association
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Hidden Files and Directories

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan