64e8ce1f5962ec5335ad2b587272524a03234a4a18d743385384a76eeab72fc9 | Triage

Submit
Reports

Overview

overview

Static

static

5

0bbff68139...e3.exe

windows7-x64

0bbff68139...e3.exe

windows10-2004-x64

7

Sharing

General

Target

0bbff681392700ab2b69374b9350ade3
Size

512KB
Sample

231230-czx4rafcf7
MD5

0bbff681392700ab2b69374b9350ade3
SHA1

32f49a74c2a4166c800e4ac0e4c9248f47b17aed
SHA256

64e8ce1f5962ec5335ad2b587272524a03234a4a18d743385384a76eeab72fc9
SHA512

8088628efc5d8d6bbf8f36b1b6dac4125ca4a15f69be148c65dc4cb37520811660f2367307b769d6ec50c2d542499f790c8bfb68f1c972b6454ad2a364d3a9fe
SSDEEP

6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E

Score

10^/10

evasion persistence trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

0bbff681392700ab2b69374b9350ade3.exe

Resource

win7-20231215-en

evasion persistence trojan

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

0bbff681392700ab2b69374b9350ade3.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  0bbff681392700ab2b69374b9350ade3
- Size
  
  512KB
- MD5
  
  0bbff681392700ab2b69374b9350ade3
- SHA1
  
  32f49a74c2a4166c800e4ac0e4c9248f47b17aed
- SHA256
  
  64e8ce1f5962ec5335ad2b587272524a03234a4a18d743385384a76eeab72fc9
- SHA512
  
  8088628efc5d8d6bbf8f36b1b6dac4125ca4a15f69be148c65dc4cb37520811660f2367307b769d6ec50c2d542499f790c8bfb68f1c972b6454ad2a364d3a9fe
- SSDEEP
  
  6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E
Score

10^/10

evasion persistence trojan
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

© 2018-2024

Terms | Privacy