04c794ccadb88fd873cf305b68e0d6120f50767c903e26cbed304b066d86eb4d | Triage

Sharing

General

Target

04c794ccadb88fd873cf305b68e0d6120f50767c903e26cbed304b066d86eb4d
Size

69KB
Sample

240305-vvka7sda79
MD5

a233b019f082c9b225c9fba305b9e37e
SHA1

b5e71b5f598ebba4316eba66b85d35a9293da4cd
SHA256

04c794ccadb88fd873cf305b68e0d6120f50767c903e26cbed304b066d86eb4d
SHA512

f0955b4d017666f49b49b03b831c7978c6c8578f558a96b137ad32354986df3c6966e9767262bcd02abf3cbdd7cf2c376a726271677d49685339ee9197dce207
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8EO:Olg35GTslA5t3/w8F

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  04c794ccadb88fd873cf305b68e0d6120f50767c903e26cbed304b066d86eb4d
- Size
  
  69KB
- MD5
  
  a233b019f082c9b225c9fba305b9e37e
- SHA1
  
  b5e71b5f598ebba4316eba66b85d35a9293da4cd
- SHA256
  
  04c794ccadb88fd873cf305b68e0d6120f50767c903e26cbed304b066d86eb4d
- SHA512
  
  f0955b4d017666f49b49b03b831c7978c6c8578f558a96b137ad32354986df3c6966e9767262bcd02abf3cbdd7cf2c376a726271677d49685339ee9197dce207
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8EO:Olg35GTslA5t3/w8F
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan