37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d | Triage

Sharing

General

Target

37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d
Size

141KB
Sample

221123-s8r7vsgd6t
MD5

f707bbac715d9589520b85a956998fcf
SHA1

657e884d65f9084f73897e7d392019096fa6e795
SHA256

37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d
SHA512

7622f75ef15afbd66be0d8f0b60c88c4f798708c1aed2187aea56ad193dd0444dd2b13d356268fd57e578ccb4c084e747bb7261245b65ae5157428b2450ddbf2
SSDEEP

3072:3N7Gw2n0nPBm/hIY3AdFxLrPvSySMiXfn0TI:3NJ2/hIY3MMdfn0M

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d
- Size
  
  141KB
- MD5
  
  f707bbac715d9589520b85a956998fcf
- SHA1
  
  657e884d65f9084f73897e7d392019096fa6e795
- SHA256
  
  37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d
- SHA512
  
  7622f75ef15afbd66be0d8f0b60c88c4f798708c1aed2187aea56ad193dd0444dd2b13d356268fd57e578ccb4c084e747bb7261245b65ae5157428b2450ddbf2
- SSDEEP
  
  3072:3N7Gw2n0nPBm/hIY3AdFxLrPvSySMiXfn0TI:3NJ2/hIY3MMdfn0M
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2