Overview

overview

10

Static

static

a9568c6649...f9.exe

windows7-x64

10

a9568c6649...f9.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9568c664952a6ab384fc9901fdb9fb9b12a2bcdaf5327fed154a56bc96623f9

  • Size

    194KB

  • Sample

    221125-h4vgbadh9y

  • MD5

    d97abd907baf7ce7250c2e6fb66cdf39

  • SHA1

    82420fe1d8efa0f1122dda39a05ee120955fd76c

  • SHA256

    a9568c664952a6ab384fc9901fdb9fb9b12a2bcdaf5327fed154a56bc96623f9

  • SHA512

    882fa7e5c79a37c5575acf395f77d78019dc8f8d4f020f320f68238a4e2c50f254040bee8b5a1983cff17dcf8bf61d535589f96b0575b9a50fec1fa236866bde

  • SSDEEP

    3072:lt5y3I0xY1ECtsY41XyGaALHPJ3XXbCDh2FmEhp5pxYgTYCX:pgTzCt/4OAB3nbCN2cSxdX

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      a9568c664952a6ab384fc9901fdb9fb9b12a2bcdaf5327fed154a56bc96623f9

    • Size

      194KB

    • MD5

      d97abd907baf7ce7250c2e6fb66cdf39

    • SHA1

      82420fe1d8efa0f1122dda39a05ee120955fd76c

    • SHA256

      a9568c664952a6ab384fc9901fdb9fb9b12a2bcdaf5327fed154a56bc96623f9

    • SHA512

      882fa7e5c79a37c5575acf395f77d78019dc8f8d4f020f320f68238a4e2c50f254040bee8b5a1983cff17dcf8bf61d535589f96b0575b9a50fec1fa236866bde

    • SSDEEP

      3072:lt5y3I0xY1ECtsY41XyGaALHPJ3XXbCDh2FmEhp5pxYgTYCX:pgTzCt/4OAB3nbCN2cSxdX

    Score
    10/10
    evasionpersistencetrojan

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Disables taskbar notifications via registry modification

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

3
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks