79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e | Triage

Submit
Reports

Overview

overview

Static

static

79cb60306c...6e.exe

windows7-x64

79cb60306c...6e.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

Target

79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e
Size

1016KB
Sample

221123-xhkgjsfa83
MD5

5363730898d77d9b8374b0fc57ca4520
SHA1

a51bd285c4f2309533c6696fa3023843869b521d
SHA256

79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e
SHA512

2bb86aa6835d6c6d2f66ba53bf1dd4a66d008ed386a5ee485bc5a755ce2949aaea6910396d74f9a70b00660f9ed7c6c751c62f3604ded1ff12ffc114a8a3f970
SSDEEP

6144:jIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmDa1is0f:jIXsgtvm1De5YlOx6lzBH46Umu1q

Score

10^/10

evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e.exe

Resource

win7-20220812-en

evasion persistence trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e
- Size
  
  1016KB
- MD5
  
  5363730898d77d9b8374b0fc57ca4520
- SHA1
  
  a51bd285c4f2309533c6696fa3023843869b521d
- SHA256
  
  79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e
- SHA512
  
  2bb86aa6835d6c6d2f66ba53bf1dd4a66d008ed386a5ee485bc5a755ce2949aaea6910396d74f9a70b00660f9ed7c6c751c62f3604ded1ff12ffc114a8a3f970
- SSDEEP
  
  6144:jIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmDa1is0f:jIXsgtvm1De5YlOx6lzBH46Umu1q
Score

10^/10

evasion persistence trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

© 2018-2025

Terms | Privacy