cae3c3d9502f4aaca6ceeb6367fd40e57fab53000bca2f0fb5952b35c72420f8 | Triage

Sharing

General

Target

cae3c3d9502f4aaca6ceeb6367fd40e57fab53000bca2f0fb5952b35c72420f8
Size

183KB
Sample

221123-s8h9ysgd4t
MD5

d813f7129e47df6ca0cc9d59789efaf3
SHA1

ed6d6ed7fecaa7dcb821c5a174e581d06ca3c6df
SHA256

cae3c3d9502f4aaca6ceeb6367fd40e57fab53000bca2f0fb5952b35c72420f8
SHA512

ca213615a91098d84e4acf3abce29e6272e1b1b0f6282ff690c1520a2f8c0ada658f06d24216f888a5267586b37d4f44a6b11e029c16806c7c831b2b01abd7e9
SSDEEP

3072:Xfnyzy1PY3HqZCzxytbvls4qQXvvSGunAYUReetPTWh98:Xqzy1wyCAbNs4qQXvvSD7exW4

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  cae3c3d9502f4aaca6ceeb6367fd40e57fab53000bca2f0fb5952b35c72420f8
- Size
  
  183KB
- MD5
  
  d813f7129e47df6ca0cc9d59789efaf3
- SHA1
  
  ed6d6ed7fecaa7dcb821c5a174e581d06ca3c6df
- SHA256
  
  cae3c3d9502f4aaca6ceeb6367fd40e57fab53000bca2f0fb5952b35c72420f8
- SHA512
  
  ca213615a91098d84e4acf3abce29e6272e1b1b0f6282ff690c1520a2f8c0ada658f06d24216f888a5267586b37d4f44a6b11e029c16806c7c831b2b01abd7e9
- SSDEEP
  
  3072:Xfnyzy1PY3HqZCzxytbvls4qQXvvSGunAYUReetPTWh98:Xqzy1wyCAbNs4qQXvvSD7exW4
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2