34a62f3dfa68660ab152a8e9ed442568330fc8ff7c0e7e6ea6bede65d3d80cd2 | Triage

Sharing

General

Target

34a62f3dfa68660ab152a8e9ed442568330fc8ff7c0e7e6ea6bede65d3d80cd2
Size

72KB
Sample

240522-y5a23afb3x
MD5

91698ca6057bbb4b01697f6bd9842f1a
SHA1

578dc1a67651ca68217242bf7ca4462c5e126a37
SHA256

34a62f3dfa68660ab152a8e9ed442568330fc8ff7c0e7e6ea6bede65d3d80cd2
SHA512

e7690c3e34cb667640a69d14103b7c6942634a649b2cd91dd165e4fe4d618a113dd5e6cd15c4ea3777106595b31fc04beac9f060137326b6072191cfb763f94d
SSDEEP

1536:xGrOhMC7Nb20g6HKF02z5HKgeBGmW9aSL:wrOhRvN2sGmtO

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  34a62f3dfa68660ab152a8e9ed442568330fc8ff7c0e7e6ea6bede65d3d80cd2
- Size
  
  72KB
- MD5
  
  91698ca6057bbb4b01697f6bd9842f1a
- SHA1
  
  578dc1a67651ca68217242bf7ca4462c5e126a37
- SHA256
  
  34a62f3dfa68660ab152a8e9ed442568330fc8ff7c0e7e6ea6bede65d3d80cd2
- SHA512
  
  e7690c3e34cb667640a69d14103b7c6942634a649b2cd91dd165e4fe4d618a113dd5e6cd15c4ea3777106595b31fc04beac9f060137326b6072191cfb763f94d
- SSDEEP
  
  1536:xGrOhMC7Nb20g6HKF02z5HKgeBGmW9aSL:wrOhRvN2sGmtO
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan