1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee | Triage

Sharing

General

Target

1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee.exe
Size

829KB
Sample

240508-n8k2bsbe8y
MD5

664eddacb00d2d58f85cdc2913a1680e
SHA1

3dfce1917291ff78513dba84e8ac715700d814d7
SHA256

1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee
SHA512

a7c3be40568a5b531b648497be3a4e1abe7408e75a2981575b4858a945c66958af0eb01c4abc4c135f83c120e6f50d6cf148dca1b79b82dc2c9b7185406d4893
SSDEEP

12288:Ejwz+S8matk6SosnQq8xMdzq/0P5uxvSpN1HVuX+1Bhkc92Wkdu7n1Gwi:8wCSwk6SotJguxvCN1HVuO1rjFkG18

Score

10^/10

evasion execution trojan

Malware Config

Targets

- Target
  
  1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee.exe
- Size
  
  829KB
- MD5
  
  664eddacb00d2d58f85cdc2913a1680e
- SHA1
  
  3dfce1917291ff78513dba84e8ac715700d814d7
- SHA256
  
  1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee
- SHA512
  
  a7c3be40568a5b531b648497be3a4e1abe7408e75a2981575b4858a945c66958af0eb01c4abc4c135f83c120e6f50d6cf148dca1b79b82dc2c9b7185406d4893
- SSDEEP
  
  12288:Ejwz+S8matk6SosnQq8xMdzq/0P5uxvSpN1HVuX+1Bhkc92Wkdu7n1Gwi:8wCSwk6SotJguxvCN1HVuO1rjFkG18
Score

10^/10

evasion execution trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionexecutiontrojan