77d0e697edfe2dfa3fbff5f5245f57bb56469c46761a9b9dff34b6599e11f68a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

77d0e697edfe2dfa3fbff5f5245f57bb56469c46761a9b9dff34b6599e11f68a
Size

1.4MB
Sample

231012-zfpdtsbd8w
MD5

f4a743d018d45866e46304f1d11ec8a8
SHA1

21eae1f2a2500d4d33f3d93c491987c2f47827b5
SHA256

77d0e697edfe2dfa3fbff5f5245f57bb56469c46761a9b9dff34b6599e11f68a
SHA512

4bf963b4ca2889c9ac3e9cf886c7ba3c892e603787e7ed9a6fbe1fe7b044ee36dd173afc888f5a2554ab9248dcd8452cc7192b2cabd498dc2d310df8c1ccc51e
SSDEEP

24576:myAC+fAR61dWYbbew3RN7wg/iUTwnTA0iFtV3PdLjYzYdtGtG9/2/ogWBA5ft0iV:1n+fARWQYthVwK/wTgFP3l/Yzst/2ggr

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  77d0e697edfe2dfa3fbff5f5245f57bb56469c46761a9b9dff34b6599e11f68a
- Size
  
  1.4MB
- MD5
  
  f4a743d018d45866e46304f1d11ec8a8
- SHA1
  
  21eae1f2a2500d4d33f3d93c491987c2f47827b5
- SHA256
  
  77d0e697edfe2dfa3fbff5f5245f57bb56469c46761a9b9dff34b6599e11f68a
- SHA512
  
  4bf963b4ca2889c9ac3e9cf886c7ba3c892e603787e7ed9a6fbe1fe7b044ee36dd173afc888f5a2554ab9248dcd8452cc7192b2cabd498dc2d310df8c1ccc51e
- SSDEEP
  
  24576:myAC+fAR61dWYbbew3RN7wg/iUTwnTA0iFtV3PdLjYzYdtGtG9/2/ogWBA5ft0iV:1n+fARWQYthVwK/wTgFP3l/Yzst/2ggr
Score

10^/10

evasion persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan