0027371e9c66ebb9efa8d9110457ba43119448978a2eb15409bbb9f131abb1a8 | Triage

Sharing

General

Target

0027371e9c66ebb9efa8d9110457ba43119448978a2eb15409bbb9f131abb1a8
Size

183KB
Sample

221126-2267wafc3y
MD5

1b800156ec4ebb5def197bd01f07e7d9
SHA1

ae0ce630a267c0f7e2011c1cf0884385b6ecd718
SHA256

0027371e9c66ebb9efa8d9110457ba43119448978a2eb15409bbb9f131abb1a8
SHA512

21f2cb5f09a42afd333d2433444a4296019fb42a7829be95d26fd8085317af71b4e5e2f66abbf8714a98bd01b9fc65d58554d9c1f22115627b7bee3c72455958
SSDEEP

1536:d+MwtP+jOPdIk89PAy/t0rNkbml/0Euke29u6Rts5MZP:LwtEkSPAy/tvbT29Bky

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  0027371e9c66ebb9efa8d9110457ba43119448978a2eb15409bbb9f131abb1a8
- Size
  
  183KB
- MD5
  
  1b800156ec4ebb5def197bd01f07e7d9
- SHA1
  
  ae0ce630a267c0f7e2011c1cf0884385b6ecd718
- SHA256
  
  0027371e9c66ebb9efa8d9110457ba43119448978a2eb15409bbb9f131abb1a8
- SHA512
  
  21f2cb5f09a42afd333d2433444a4296019fb42a7829be95d26fd8085317af71b4e5e2f66abbf8714a98bd01b9fc65d58554d9c1f22115627b7bee3c72455958
- SSDEEP
  
  1536:d+MwtP+jOPdIk89PAy/t0rNkbml/0Euke29u6Rts5MZP:LwtEkSPAy/tvbT29Bky
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2