9f902bc60775f4883f454f703a29776a0c8d5728aa0dda90c4cfba6173e3732b | Triage

Sharing

General

Target

9f902bc60775f4883f454f703a29776a0c8d5728aa0dda90c4cfba6173e3732b
Size

1.9MB
Sample

231004-yhcblsee9v
MD5

8664d58aade098cbb69d372425345bd0
SHA1

5aae99c1772ba3708d689bd211551c14160360db
SHA256

9f902bc60775f4883f454f703a29776a0c8d5728aa0dda90c4cfba6173e3732b
SHA512

15eff359cdf613d2629aba7e10e6db6a3173a61ffa0d5c67b2c60c2acf1f91d72f78f3a87191b0ce725a753e533fa9fb75274de74c6c63cd1149019de2e66819
SSDEEP

49152:LRY+JJbrVVLGsRlOLIlMBkDJAIqy1j8uc8yzHEaNeTaW:1BrVZGsX9lAk1Gy1jtc8yzHO

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  9f902bc60775f4883f454f703a29776a0c8d5728aa0dda90c4cfba6173e3732b
- Size
  
  1.9MB
- MD5
  
  8664d58aade098cbb69d372425345bd0
- SHA1
  
  5aae99c1772ba3708d689bd211551c14160360db
- SHA256
  
  9f902bc60775f4883f454f703a29776a0c8d5728aa0dda90c4cfba6173e3732b
- SHA512
  
  15eff359cdf613d2629aba7e10e6db6a3173a61ffa0d5c67b2c60c2acf1f91d72f78f3a87191b0ce725a753e533fa9fb75274de74c6c63cd1149019de2e66819
- SSDEEP
  
  49152:LRY+JJbrVVLGsRlOLIlMBkDJAIqy1j8uc8yzHEaNeTaW:1BrVZGsX9lAk1Gy1jtc8yzHO
Score

10^/10

evasion persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan