e5e75423970d90ad62d6edd3d72ba04bd94e6b687f9348729e3416b173e660d6 | Triage

Sharing

General

Target

e5e75423970d90ad62d6edd3d72ba04bd94e6b687f9348729e3416b173e660d6
Size

35KB
Sample

221127-ajxf6sfa82
MD5

cfa184ffcdcdf871b2adf13ac870f7c2
SHA1

e428847d7c56389db4794ee5ac3750f379807e71
SHA256

e5e75423970d90ad62d6edd3d72ba04bd94e6b687f9348729e3416b173e660d6
SHA512

9bffb6682bca0eb4e36dec7a3ba9fcc50379048199b34102104de0bc8ad3cae91c1e316b45dce6adbb24de5cc281b8c97a15589e69c63c00a003b827e52859ec
SSDEEP

768:LQDlvOHDMLJ1b99ONLh2cBDz0wKhQURLVesm8Kxgdl2RIwOIL:UDlGH4Lvb99ONlFDhBuP26wBL

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  notification.exe
- Size
  
  57KB
- MD5
  
  310da20a626d85819d981eddeb32ed27
- SHA1
  
  119be6fd440e39db4b6dd2459b9b9a2cde938ec5
- SHA256
  
  cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729
- SHA512
  
  9afca8f0bc415b678e717c766457b7adde1d28107fafdbc6f75457845232a34f2bc1b6f764d3abed3893b1290a717b64e9508c34b8472d10a4277a5b779d1ad8
- SSDEEP
  
  768:Jf5kuRDCss6nA+MiS1RlY8IAtf0ey3+NAKY7ohturWfADGjS5qQDJ7w6:3k2DW+MHQAd0F3+NXcK5+Ei
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2