af63f4fa7e73e0ac433ba650c204b9932d2fe74e4f1e702efee30d0223f16f82 | Triage

Sharing

General

Target

af63f4fa7e73e0ac433ba650c204b9932d2fe74e4f1e702efee30d0223f16f82
Size

71KB
Sample

240523-cclr7shg22
MD5

3952dd4d48323c4053659b88b0435041
SHA1

6e4f6fe329af8353e1b1de70574f3d9d407b2ca8
SHA256

af63f4fa7e73e0ac433ba650c204b9932d2fe74e4f1e702efee30d0223f16f82
SHA512

673179aaa7cd6618f5c02b139ca1acf501ab9861778ce0ed81229aa677fa03ac182647b5cdcef64c9a0f6f9e8f454ab9010c32d88145ac77cfee8042cb857eb0
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slN:Olg35GTslA5t3/w8k

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  af63f4fa7e73e0ac433ba650c204b9932d2fe74e4f1e702efee30d0223f16f82
- Size
  
  71KB
- MD5
  
  3952dd4d48323c4053659b88b0435041
- SHA1
  
  6e4f6fe329af8353e1b1de70574f3d9d407b2ca8
- SHA256
  
  af63f4fa7e73e0ac433ba650c204b9932d2fe74e4f1e702efee30d0223f16f82
- SHA512
  
  673179aaa7cd6618f5c02b139ca1acf501ab9861778ce0ed81229aa677fa03ac182647b5cdcef64c9a0f6f9e8f454ab9010c32d88145ac77cfee8042cb857eb0
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slN:Olg35GTslA5t3/w8k
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan