Overview

overview

10

Static

static

b0fac756b7...49.exe

windows7-x64

10

b0fac756b7...49.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49

  • Size

    92KB

  • Sample

    221123-s8l1vadc78

  • MD5

    c21c38a2f12e9abcab403ce7b3b8121d

  • SHA1

    483a57b1ef186b36352d482804740d1df3726053

  • SHA256

    b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49

  • SHA512

    e85ba71603d6f50fe61688fcda732d128e9a445f9b153f48c3d733ea5921cff549eb2ab76ebda9227ffe93d0578374fb4acd736ced93c3b5eab7fb8350070bcb

  • SSDEEP

    1536:EXZnsm2QX9DjWWdPBnQ/G6l/IU9KNWMwDz/xsz5FpTq:Hm245W//G6dONI2z5/q

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49

    • Size

      92KB

    • MD5

      c21c38a2f12e9abcab403ce7b3b8121d

    • SHA1

      483a57b1ef186b36352d482804740d1df3726053

    • SHA256

      b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49

    • SHA512

      e85ba71603d6f50fe61688fcda732d128e9a445f9b153f48c3d733ea5921cff549eb2ab76ebda9227ffe93d0578374fb4acd736ced93c3b5eab7fb8350070bcb

    • SSDEEP

      1536:EXZnsm2QX9DjWWdPBnQ/G6l/IU9KNWMwDz/xsz5FpTq:Hm245W//G6dONI2z5/q

    Score
    10/10
    evasionpersistencetrojan

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Disables taskbar notifications via registry modification

      evasion

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

3
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks