631508d9fa856a849a8693d03bdbc6ff10022e1ba74bd7e83319ee3b0cb20fde | Triage

Sharing

General

Target

631508d9fa856a849a8693d03bdbc6ff10022e1ba74bd7e83319ee3b0cb20fde
Size

31KB
Sample

221203-hyya1sec89
MD5

aad776dfd31f088920a489eb2433a718
SHA1

dbbcb872085f97a4f0dbab09aba741a83009c607
SHA256

631508d9fa856a849a8693d03bdbc6ff10022e1ba74bd7e83319ee3b0cb20fde
SHA512

b811b9bbd332f3f7dde3d10c918a88b0f469e846035c8f015a4e5f319410b725226b579c1c22ba5f4e9f9e09e4f13fd1e80efb48b08f4a4bf111c1cd59df0fac
SSDEEP

768:XeVJMedxVWT1q1kJ2yxQhUwMDlhT3IspEOYaRnbcuyD7UjNWGb:ukWnMq1e2MhnDltIspEOYcnouy8Jh

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  631508d9fa856a849a8693d03bdbc6ff10022e1ba74bd7e83319ee3b0cb20fde
- Size
  
  31KB
- MD5
  
  aad776dfd31f088920a489eb2433a718
- SHA1
  
  dbbcb872085f97a4f0dbab09aba741a83009c607
- SHA256
  
  631508d9fa856a849a8693d03bdbc6ff10022e1ba74bd7e83319ee3b0cb20fde
- SHA512
  
  b811b9bbd332f3f7dde3d10c918a88b0f469e846035c8f015a4e5f319410b725226b579c1c22ba5f4e9f9e09e4f13fd1e80efb48b08f4a4bf111c1cd59df0fac
- SSDEEP
  
  768:XeVJMedxVWT1q1kJ2yxQhUwMDlhT3IspEOYaRnbcuyD7UjNWGb:ukWnMq1e2MhnDltIspEOYcnouy8Jh
Score

10^/10

evasion persistence trojan
- UAC bypass
  evasion trojan
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2