b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e | Triage

Sharing

General

Target

b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e
Size

158KB
Sample

221123-qk9qwshc4s
MD5

55cf1b172599ae1399e7bfd0a671dacb
SHA1

2f4c1211e9bfaf92340af0cb87e4d36b71225490
SHA256

b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e
SHA512

5e766ca4dd255628410672008639d949a8653d9497220500b2c0880106e05d8365a027ae6eec04f1e93a5bdc36772eb33ad8f03ba05faa1270d39966bbaf3138
SSDEEP

3072:fp05OSx+nkwOu9Rs3m1FvBcMPNEFrOXkj49B1w:fdKwkwOERsQPNZ0Ae

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e
- Size
  
  158KB
- MD5
  
  55cf1b172599ae1399e7bfd0a671dacb
- SHA1
  
  2f4c1211e9bfaf92340af0cb87e4d36b71225490
- SHA256
  
  b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e
- SHA512
  
  5e766ca4dd255628410672008639d949a8653d9497220500b2c0880106e05d8365a027ae6eec04f1e93a5bdc36772eb33ad8f03ba05faa1270d39966bbaf3138
- SSDEEP
  
  3072:fp05OSx+nkwOu9Rs3m1FvBcMPNEFrOXkj49B1w:fdKwkwOERsQPNZ0Ae
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2