f49585c2301e57fd829eb0ba4f7ad95cccf8ea73f503810f18036de9e3fbe8c4 | Triage

Sharing

General

Target

e07cf71aa11eaba37ecaf5b7caf6b4b0N.exe
Size

44KB
Sample

240825-b3zw3stalj
MD5

e07cf71aa11eaba37ecaf5b7caf6b4b0
SHA1

1b987d0916443ee56da185987dc483f2d26fd88d
SHA256

f49585c2301e57fd829eb0ba4f7ad95cccf8ea73f503810f18036de9e3fbe8c4
SHA512

d42555afdfd09de8c7f5e0aaf7061adce9f676014d7785932af999a3dbfde69aa26dd348c7c1769b3c6ca4f9d9919fe1d85e62f880359bcdce5d5afcd178de55
SSDEEP

768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvRWrETR5:RUNHFKQbIkHvGkAzWR5

Score

10^/10

defense_evasion discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  e07cf71aa11eaba37ecaf5b7caf6b4b0N.exe
- Size
  
  44KB
- MD5
  
  e07cf71aa11eaba37ecaf5b7caf6b4b0
- SHA1
  
  1b987d0916443ee56da185987dc483f2d26fd88d
- SHA256
  
  f49585c2301e57fd829eb0ba4f7ad95cccf8ea73f503810f18036de9e3fbe8c4
- SHA512
  
  d42555afdfd09de8c7f5e0aaf7061adce9f676014d7785932af999a3dbfde69aa26dd348c7c1769b3c6ca4f9d9919fe1d85e62f880359bcdce5d5afcd178de55
- SSDEEP
  
  768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvRWrETR5:RUNHFKQbIkHvGkAzWR5
Score

10^/10

defense_evasion discovery evasion persistence trojan
- Windows security bypass
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Impair Defenses

Disable or Modify Tools

Indicator Removal

Clear Persistence

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistencetrojan

behavioral2

defense_evasiondiscoveryevasionpersistencetrojan