5123464f02eb63e96e020c6c727185b62e53d894c96fb71901b2f491554120d4 | Triage

Sharing

General

Target

5123464f02eb63e96e020c6c727185b62e53d894c96fb71901b2f491554120d4
Size

40KB
Sample

221123-yc1f9ahf99
MD5

be3485f464fa3de9ec062c8f7b60cad7
SHA1

9e9f2d642082bbc35d451abcfddb14418f7ef01e
SHA256

5123464f02eb63e96e020c6c727185b62e53d894c96fb71901b2f491554120d4
SHA512

3b95d4c69da57e2ea14a3282a8b32e56d371f1afcae9ecf410c3ac35925f33fff3615480787db86d3d40ba0ae731d8aac41bd86f526dc1668e4f7e55fbcfedee
SSDEEP

768:H69QNrE0KFgoPgT7jnEodRbBL45OawcJo3fsCArTJmYehOk5cCt:a9UKFqpzVLuxCfKvJ1ehO6cCt

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  transact_store/transact_e5ebfdsd6211.exe
- Size
  
  58KB
- MD5
  
  182ee0f73cd9743985ceb3248400fd44
- SHA1
  
  a3be64e08d2190fc54c3732090e4888a2162578c
- SHA256
  
  8a23558f6b59c714495ad9753609f359bd025b6bb205b8ac00a7a84ed1372589
- SHA512
  
  6e0135ce9c715e95e3b3e4328d50a8b4822e9cde36d4e60b7c370dcb3892dfe4e08d6b201f4d60c3e33f37514179bf747fa37a475f4589e5b15280ac657fc262
- SSDEEP
  
  1536:cQCQKXujec19h2F0plccw9ZFvXR2dowZypaXTNSLO6:lFsh2pEdXR2IV
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2