c03cb34c76f7fd6b96643a4d3a745d7a9af3bfeda4b75c0d46c2314d302d3f19 | Triage

Sharing

General

Target

c03cb34c76f7fd6b96643a4d3a745d7a9af3bfeda4b75c0d46c2314d302d3f19
Size

304KB
Sample

221123-s8hnesgd4s
MD5

7497c979d01b3591de8ca6afc15a1be5
SHA1

a955f8d535ad61dfe8fe2052b1be033284a9c363
SHA256

c03cb34c76f7fd6b96643a4d3a745d7a9af3bfeda4b75c0d46c2314d302d3f19
SHA512

8ffee5684610a7a9784c9eb1070e4ca522fb0b5887d30ac017c5f826bb6055f6f2514f02de7194cc6c938fa25280f038bf4060f8723d016bfd5458346a47c2d5
SSDEEP

1536:MakYgQrqK1rXhc4eu229cNyVz+TAyOhUiy0SYyywQaOqTm7RF9Yi40nDL1MIQ:MIc4eu22ect+kyOh6UZq0QorQ

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  c03cb34c76f7fd6b96643a4d3a745d7a9af3bfeda4b75c0d46c2314d302d3f19
- Size
  
  304KB
- MD5
  
  7497c979d01b3591de8ca6afc15a1be5
- SHA1
  
  a955f8d535ad61dfe8fe2052b1be033284a9c363
- SHA256
  
  c03cb34c76f7fd6b96643a4d3a745d7a9af3bfeda4b75c0d46c2314d302d3f19
- SHA512
  
  8ffee5684610a7a9784c9eb1070e4ca522fb0b5887d30ac017c5f826bb6055f6f2514f02de7194cc6c938fa25280f038bf4060f8723d016bfd5458346a47c2d5
- SSDEEP
  
  1536:MakYgQrqK1rXhc4eu229cNyVz+TAyOhUiy0SYyywQaOqTm7RF9Yi40nDL1MIQ:MIc4eu22ect+kyOh6UZq0QorQ
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2