89ce33dc0327cc234549cf35fb7d779598887b7449c29ac29925b0c369a64bf0 | Triage

Submit
Reports

Overview

overview

Static

static

89ce33dc03...f0.exe

windows7-x64

89ce33dc03...f0.exe

windows10-2004-x64

8

Sharing

General

Target

89ce33dc0327cc234549cf35fb7d779598887b7449c29ac29925b0c369a64bf0
Size

451KB
Sample

221124-gjzpvscg57
MD5

824349dc3ead9c6d3ed6b4c61f84d57d
SHA1

4c367f0ede639de7cd0fa2c8cd42f044c92ada1f
SHA256

89ce33dc0327cc234549cf35fb7d779598887b7449c29ac29925b0c369a64bf0
SHA512

d77aec700fd8e540b41194d7adb0dd349db1b1f75195771bf08dde7bfe1cc865d6e5f3a7e9c92bb091fab1194a18b372c74efdb9b53525fc665390283b553e80
SSDEEP

12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTjS6:JoC7ijwFKlVadZ3+8qN9

Score

10^/10

evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

89ce33dc0327cc234549cf35fb7d779598887b7449c29ac29925b0c369a64bf0.exe

Resource

win7-20221111-en

evasion persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

89ce33dc0327cc234549cf35fb7d779598887b7449c29ac29925b0c369a64bf0.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  89ce33dc0327cc234549cf35fb7d779598887b7449c29ac29925b0c369a64bf0
- Size
  
  451KB
- MD5
  
  824349dc3ead9c6d3ed6b4c61f84d57d
- SHA1
  
  4c367f0ede639de7cd0fa2c8cd42f044c92ada1f
- SHA256
  
  89ce33dc0327cc234549cf35fb7d779598887b7449c29ac29925b0c369a64bf0
- SHA512
  
  d77aec700fd8e540b41194d7adb0dd349db1b1f75195771bf08dde7bfe1cc865d6e5f3a7e9c92bb091fab1194a18b372c74efdb9b53525fc665390283b553e80
- SSDEEP
  
  12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTjS6:JoC7ijwFKlVadZ3+8qN9
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

© 2018-2024

Terms | Privacy