307f3226b8dca79c6fb29b3f41a543fd1bb896d00fe64e165f2461134dde9687 | Triage

Sharing

General

Target

307f3226b8dca79c6fb29b3f41a543fd1bb896d00fe64e165f2461134dde9687
Size

118KB
Sample

221125-dpkw4sgc99
MD5

ba7e5f6669665efa112abc5335c14d00
SHA1

bb78c4f8dcf0c557302389e4297763f7cd1dbfc8
SHA256

307f3226b8dca79c6fb29b3f41a543fd1bb896d00fe64e165f2461134dde9687
SHA512

fe62aa93d4f4a29a4031d3b60e5c2a25df86a59e3ab01280e9acf5c56eabb8d6e0b4ad0a4bc9bdbfd44d93cb405813ae4c76be2dfaa4f0580d69eb052a4147cd
SSDEEP

3072:0QJrsw+W2cjUOgngIHy9yrT5CtHvazixI6s:0Qh+ySnQtHvaz2I1

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  307f3226b8dca79c6fb29b3f41a543fd1bb896d00fe64e165f2461134dde9687
- Size
  
  118KB
- MD5
  
  ba7e5f6669665efa112abc5335c14d00
- SHA1
  
  bb78c4f8dcf0c557302389e4297763f7cd1dbfc8
- SHA256
  
  307f3226b8dca79c6fb29b3f41a543fd1bb896d00fe64e165f2461134dde9687
- SHA512
  
  fe62aa93d4f4a29a4031d3b60e5c2a25df86a59e3ab01280e9acf5c56eabb8d6e0b4ad0a4bc9bdbfd44d93cb405813ae4c76be2dfaa4f0580d69eb052a4147cd
- SSDEEP
  
  3072:0QJrsw+W2cjUOgngIHy9yrT5CtHvazixI6s:0Qh+ySnQtHvaz2I1
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2