c9e9d5793cab3f43e2afaf43ec745fde5011cf7bc09377658397cc8f19108985 | Triage

Sharing

General

Target

c9e9d5793cab3f43e2afaf43ec745fde5011cf7bc09377658397cc8f19108985
Size

485KB
Sample

221203-qe4mpacg79
MD5

af8514ea42d861c133c5d3d1f862ebac
SHA1

05ede52d8a65fbbf292baaee0d929434eae31b88
SHA256

c9e9d5793cab3f43e2afaf43ec745fde5011cf7bc09377658397cc8f19108985
SHA512

6738834d1b0cb10e7db98499da4b78e4774cef684178dbee0591f786a802144ceaf7fe0fab656d3e0768b00a60fd3a52ef8828aec02f8e61d13266f3ad877197
SSDEEP

12288:WkOxSBxYJSMjd+HrP8svTm1w7Xugf3mfOec:WkOGISwwD3rm6am

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  c9e9d5793cab3f43e2afaf43ec745fde5011cf7bc09377658397cc8f19108985
- Size
  
  485KB
- MD5
  
  af8514ea42d861c133c5d3d1f862ebac
- SHA1
  
  05ede52d8a65fbbf292baaee0d929434eae31b88
- SHA256
  
  c9e9d5793cab3f43e2afaf43ec745fde5011cf7bc09377658397cc8f19108985
- SHA512
  
  6738834d1b0cb10e7db98499da4b78e4774cef684178dbee0591f786a802144ceaf7fe0fab656d3e0768b00a60fd3a52ef8828aec02f8e61d13266f3ad877197
- SSDEEP
  
  12288:WkOxSBxYJSMjd+HrP8svTm1w7Xugf3mfOec:WkOGISwwD3rm6am
Score

10^/10

evasion persistence trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables taskbar notifications via registry modification
  evasion
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2