9d323fbffaa53c64c1bafa92f305630ca48dce8cd835d8d1e4244690483c1fd7 | Triage

Sharing

General

Target

NEAS.7122634562f995d36fff8e9167b6f6c0.exe
Size

547KB
Sample

231013-y8r5raah3s
MD5

7122634562f995d36fff8e9167b6f6c0
SHA1

618c9d1688b9aaed842c4ed858ea19a4591bc536
SHA256

9d323fbffaa53c64c1bafa92f305630ca48dce8cd835d8d1e4244690483c1fd7
SHA512

7bc528ff258ddf6bfd2b94056421273ad41ebb7147e28a456ddf98a04286d072ac7e72ad76ebab8bf577b57f1607ac959a26e8c86534a7cd622e0eca7747b4d2
SSDEEP

6144:/pW2bgbbV28okoS1oWMkdlZQ5iinNrv26mYEZzROV7vdg:/pW2IoioS6pV+

Score

10^/10

discovery evasion exploit persistence trojan

Malware Config

Targets

- Target
  
  NEAS.7122634562f995d36fff8e9167b6f6c0.exe
- Size
  
  547KB
- MD5
  
  7122634562f995d36fff8e9167b6f6c0
- SHA1
  
  618c9d1688b9aaed842c4ed858ea19a4591bc536
- SHA256
  
  9d323fbffaa53c64c1bafa92f305630ca48dce8cd835d8d1e4244690483c1fd7
- SHA512
  
  7bc528ff258ddf6bfd2b94056421273ad41ebb7147e28a456ddf98a04286d072ac7e72ad76ebab8bf577b57f1607ac959a26e8c86534a7cd622e0eca7747b4d2
- SSDEEP
  
  6144:/pW2bgbbV28okoS1oWMkdlZQ5iinNrv26mYEZzROV7vdg:/pW2IoioS6pV+
Score

10^/10

discovery evasion exploit persistence trojan
- UAC bypass
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Event Triggered Execution

Change Default File Association

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

File and Directory Permissions Modification

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionexploitpersistencetrojan

behavioral2

discoveryevasionexploitpersistencetrojan