dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e | Triage

Sharing

General

Target

dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e
Size

205KB
Sample

221123-mqtp3seg45
MD5

7d6d340475a4877e7c145d0719eb6e83
SHA1

c7a35eff846c0d9690a8375414a28ffa62cbf776
SHA256

dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e
SHA512

3f72ddf3ae043ee392958d254cf0b64b6c686e0b13f5bcd6fc301d4ca743a76bc31c31a4d841e1ff15574c500acbc942a5a192ac742322a4b9cc45c94ef227ed
SSDEEP

3072:kqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:kqhMPssRARoiSoS3SsQLH5AK

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e
- Size
  
  205KB
- MD5
  
  7d6d340475a4877e7c145d0719eb6e83
- SHA1
  
  c7a35eff846c0d9690a8375414a28ffa62cbf776
- SHA256
  
  dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e
- SHA512
  
  3f72ddf3ae043ee392958d254cf0b64b6c686e0b13f5bcd6fc301d4ca743a76bc31c31a4d841e1ff15574c500acbc942a5a192ac742322a4b9cc45c94ef227ed
- SSDEEP
  
  3072:kqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:kqhMPssRARoiSoS3SsQLH5AK
Score

10^/10

evasion persistence trojan
- Modifies WinLogon for persistence
  persistence
- Modifies system executable filetype association
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Hidden Files and Directories

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2