e0abc4838c048ffd7598b0e52530b887ee9048c0b5ca98dbc0984b17db293631 | Triage

Sharing

General

Target

NEAS.e54f61439134cb5a2ce9bed9333e58c0.exe
Size

357KB
Sample

231028-y2pfaadg73
MD5

e54f61439134cb5a2ce9bed9333e58c0
SHA1

a2b4f0ece512cc9934824493c268c26166aac54e
SHA256

e0abc4838c048ffd7598b0e52530b887ee9048c0b5ca98dbc0984b17db293631
SHA512

80ec20727e473d60b6b1586cae0b21dac1692493bae442fc4ee23cacdd63047ffa27035afebf75d74316e364ba1436f56298543071450715af5bf3c7d4b01318
SSDEEP

6144:/pW2bgbbV28okoS1oWMkdlZQ5iinNUocMs:/pW2IoioS6C7

Score

10^/10

discovery evasion exploit persistence trojan

Malware Config

Targets

- Target
  
  NEAS.e54f61439134cb5a2ce9bed9333e58c0.exe
- Size
  
  357KB
- MD5
  
  e54f61439134cb5a2ce9bed9333e58c0
- SHA1
  
  a2b4f0ece512cc9934824493c268c26166aac54e
- SHA256
  
  e0abc4838c048ffd7598b0e52530b887ee9048c0b5ca98dbc0984b17db293631
- SHA512
  
  80ec20727e473d60b6b1586cae0b21dac1692493bae442fc4ee23cacdd63047ffa27035afebf75d74316e364ba1436f56298543071450715af5bf3c7d4b01318
- SSDEEP
  
  6144:/pW2bgbbV28okoS1oWMkdlZQ5iinNUocMs:/pW2IoioS6C7
Score

10^/10

discovery evasion exploit persistence trojan
- UAC bypass
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Event Triggered Execution

Change Default File Association

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

File and Directory Permissions Modification

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionexploitpersistencetrojan

behavioral2

evasionpersistencetrojan