f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1 | Triage

Sharing

General

Target

f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1
Size

69KB
Sample

221126-cm9l1sea79
MD5

cee8b295bcd78785d24e75f2d553850f
SHA1

96152414c813785a51ff0196ea0c49394f2c0b42
SHA256

f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1
SHA512

83359d2a03867a6441b0c1dfcdf352e3cc8bce9ff5b24091e6ae2e4e68050682edf6433554beded6df285099a1e8d6871feb64314d8d58b22e53e685d2c99ca2
SSDEEP

1536:I3RNYSo9O+NQGhrRSVV1pXNocW9YcahizM32HOYeLa:I30SB+1Bip9T+8izKOOm

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1
- Size
  
  69KB
- MD5
  
  cee8b295bcd78785d24e75f2d553850f
- SHA1
  
  96152414c813785a51ff0196ea0c49394f2c0b42
- SHA256
  
  f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1
- SHA512
  
  83359d2a03867a6441b0c1dfcdf352e3cc8bce9ff5b24091e6ae2e4e68050682edf6433554beded6df285099a1e8d6871feb64314d8d58b22e53e685d2c99ca2
- SSDEEP
  
  1536:I3RNYSo9O+NQGhrRSVV1pXNocW9YcahizM32HOYeLa:I30SB+1Bip9T+8izKOOm
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2