4541e9c844f9ad0615e582bbf6acd0aa47e29e64f414d73207ced7a846034ab0 | Triage

Sharing

General

Target

4541e9c844f9ad0615e582bbf6acd0aa47e29e64f414d73207ced7a846034ab0
Size

320KB
Sample

221125-cmd54sea22
MD5

a68f28bc5b7ef2470da93aa0c387fb62
SHA1

9805a0b9f9721a76d3a208948f12542efaadd2d2
SHA256

4541e9c844f9ad0615e582bbf6acd0aa47e29e64f414d73207ced7a846034ab0
SHA512

d1a0eeec6d060858fb2e6a531c4b44ace4929d2aeec6580ae6b3e9089dc893c2d25ea4f0d501fe17137190d64a26f2d0a72a6f4e00fa8cb57280029c239301f6
SSDEEP

6144:jNhtneNlRWpAe/h1rSPYFVqQ+FJyYwQmbX0Evg7Ja6jbNDS:1glc+YXrO7FoImglJa69S

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  4541e9c844f9ad0615e582bbf6acd0aa47e29e64f414d73207ced7a846034ab0
- Size
  
  320KB
- MD5
  
  a68f28bc5b7ef2470da93aa0c387fb62
- SHA1
  
  9805a0b9f9721a76d3a208948f12542efaadd2d2
- SHA256
  
  4541e9c844f9ad0615e582bbf6acd0aa47e29e64f414d73207ced7a846034ab0
- SHA512
  
  d1a0eeec6d060858fb2e6a531c4b44ace4929d2aeec6580ae6b3e9089dc893c2d25ea4f0d501fe17137190d64a26f2d0a72a6f4e00fa8cb57280029c239301f6
- SSDEEP
  
  6144:jNhtneNlRWpAe/h1rSPYFVqQ+FJyYwQmbX0Evg7Ja6jbNDS:1glc+YXrO7FoImglJa69S
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2