cd0914bc8d8ee678a8b4de26b80b4a3ca079e3fe96bc2a6ed40989fcff100cac | Triage

Sharing

General

Target

cd0914bc8d8ee678a8b4de26b80b4a3ca079e3fe96bc2a6ed40989fcff100cac
Size

68KB
Sample

221127-w76weahh63
MD5

4782e9db66e29234cb5bc05eb6cd8369
SHA1

bcb88f8c3648c9f39106ea038148215cac1e7b50
SHA256

cd0914bc8d8ee678a8b4de26b80b4a3ca079e3fe96bc2a6ed40989fcff100cac
SHA512

9002c35065520e8caf8b6cc65260c06d18fc6dcd096ff3d8f49adc32c77ff961e7ed488622f8364ce50a9842700b0ad7fdf853866c2bef2e017caef07718dd3a
SSDEEP

1536:firO9Yviw701mOF209dT3kTpYrvDXqxMejRi8zH:firOqviw701BF2r0zOMef

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  notification.exe
- Size
  
  124KB
- MD5
  
  bba602f3628f39f7d62edaa80cfddfe5
- SHA1
  
  c71bbfb24984c162e59e2ffbb8be69a5153af28b
- SHA256
  
  c00727651c323e461645821625a4f69a0b77bd157706373734f8ee24bc66bfca
- SHA512
  
  c6697b21b69b74da7d2e5cb1900eb95b4d4ed1d63172c956771821d960c7f3487039bd13fc6e049945c9d9db4cfb85e81a5d112758538e6e1ec0e40e33976200
- SSDEEP
  
  1536:iQOwPGF+Nn76jBwEMxqElwfGwCwFEMxqER6jBaNnU6j5zpIqq21XrH2b7Zm:B1PGsN72GwZrNb5x1b+A
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2