1324a2c62066f1d9295d78b999ae028ec5ee12c1125375d3e091e3d0b208e5eb | Triage

Sharing

General

Target

1324a2c62066f1d9295d78b999ae028ec5ee12c1125375d3e091e3d0b208e5eb
Size

1.7MB
Sample

231006-gr889shd4s
MD5

c99e79b699fa25b034f69dbd06b4e6c4
SHA1

c50714059b22caf29d085d186bfa43b92218687e
SHA256

1324a2c62066f1d9295d78b999ae028ec5ee12c1125375d3e091e3d0b208e5eb
SHA512

2d8dc01e4fa91cc8030c3c62364f81163aefda70883be61f86110206508a067cb4a738dd3c67263712399baba4f4ea08b550e4f6e2491b8370b90d727406653f
SSDEEP

49152:PVSx3hRclG4arNG8o8vMelm1x2wyWqeB0ndG37r:wNixarQiTArRyWqeB0dG37r

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  1324a2c62066f1d9295d78b999ae028ec5ee12c1125375d3e091e3d0b208e5eb
- Size
  
  1.7MB
- MD5
  
  c99e79b699fa25b034f69dbd06b4e6c4
- SHA1
  
  c50714059b22caf29d085d186bfa43b92218687e
- SHA256
  
  1324a2c62066f1d9295d78b999ae028ec5ee12c1125375d3e091e3d0b208e5eb
- SHA512
  
  2d8dc01e4fa91cc8030c3c62364f81163aefda70883be61f86110206508a067cb4a738dd3c67263712399baba4f4ea08b550e4f6e2491b8370b90d727406653f
- SSDEEP
  
  49152:PVSx3hRclG4arNG8o8vMelm1x2wyWqeB0ndG37r:wNixarQiTArRyWqeB0dG37r
Score

10^/10

evasion persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan