2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c | Triage

Sharing

General

Target

2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c
Size

124KB
Sample

221125-d1z56scc7t
MD5

67bfacc799c2ca65a240bda33380638f
SHA1

901a17800fa7e5fbead96ffdac353e35870a11ae
SHA256

2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c
SHA512

35d821603e7cff6ca80d8266890a2f09b00fe024e6ec6c1d563d4af4e6962aaabb13ff32fa50fbca0f3442d7da51bc82732ea5666db5fb72423af0ea7022e15c
SSDEEP

3072:pWVQttnaywTOmUeEgwnMjxTHyyz+HcwiYz1:pWVQ5Wz0nMZ+8wiM

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c
- Size
  
  124KB
- MD5
  
  67bfacc799c2ca65a240bda33380638f
- SHA1
  
  901a17800fa7e5fbead96ffdac353e35870a11ae
- SHA256
  
  2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c
- SHA512
  
  35d821603e7cff6ca80d8266890a2f09b00fe024e6ec6c1d563d4af4e6962aaabb13ff32fa50fbca0f3442d7da51bc82732ea5666db5fb72423af0ea7022e15c
- SSDEEP
  
  3072:pWVQttnaywTOmUeEgwnMjxTHyyz+HcwiYz1:pWVQ5Wz0nMZ+8wiM
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2