3a11b4588634a176f193d65fae91c419cd4f530a5181e60e56bcfd29a33f9cb2 | Triage

Sharing

General

Target

gdifuncs.exe
Size

5.5MB
Sample

240929-yea95s1ene
MD5

f3811d1e35cea25136e52908349f2ba3
SHA1

c8060ef0a74de26fc17d61f4aa922856a13f902c
SHA256

3a11b4588634a176f193d65fae91c419cd4f530a5181e60e56bcfd29a33f9cb2
SHA512

c51f424f1e367c00fbdae9b49f0446c89ab58f6acadab847ab788fd4a91de89886451a8ea3d7818d22c80c1c99062826b221d5ff74bee1e9e8f25fdb3b7eeb22
SSDEEP

98304:VQz+04D+i4DBz2NHlruSSDllNmd+5z/Le7q2//Le7q2:VQS04D+i4DZmLclKez/Lkq4/Lkq

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  gdifuncs.exe
- Size
  
  5.5MB
- MD5
  
  f3811d1e35cea25136e52908349f2ba3
- SHA1
  
  c8060ef0a74de26fc17d61f4aa922856a13f902c
- SHA256
  
  3a11b4588634a176f193d65fae91c419cd4f530a5181e60e56bcfd29a33f9cb2
- SHA512
  
  c51f424f1e367c00fbdae9b49f0446c89ab58f6acadab847ab788fd4a91de89886451a8ea3d7818d22c80c1c99062826b221d5ff74bee1e9e8f25fdb3b7eeb22
- SSDEEP
  
  98304:VQz+04D+i4DBz2NHlruSSDllNmd+5z/Le7q2//Le7q2:VQS04D+i4DZmLclKez/Lkq4/Lkq
Score

10^/10

discovery evasion persistence trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan