adc8361c120f88c1dd36f0069eefde0397a5f6d115a25f36beeac2da45826b77 | Triage

Sharing

General

Target

adc8361c120f88c1dd36f0069eefde0397a5f6d115a25f36beeac2da45826b77N
Size

551KB
Sample

241010-s5t72stanb
MD5

4c8a0f4f15624b88ba94c26f9d5a71f0
SHA1

d5e59ba08e8527291a3eaac309a8614283d24866
SHA256

adc8361c120f88c1dd36f0069eefde0397a5f6d115a25f36beeac2da45826b77
SHA512

c9b6276ad2a4abaefb2c12ad98db5ac31d59a22988d7ff73df61a3e5d640349ccf11466f2cf23cf2d528506926c41323ba64b60727ec23b0f24a08b273ff1e9a
SSDEEP

6144:/pW2bgbbV28okoS1oWMkdlZQ5iinNrv26FYLIcw/3SclShdYylF4vx:/pW2IoioS6p/ShdYy+x

Score

10^/10

defense_evasion discovery evasion exploit persistence trojan

Malware Config

Targets

- Target
  
  adc8361c120f88c1dd36f0069eefde0397a5f6d115a25f36beeac2da45826b77N
- Size
  
  551KB
- MD5
  
  4c8a0f4f15624b88ba94c26f9d5a71f0
- SHA1
  
  d5e59ba08e8527291a3eaac309a8614283d24866
- SHA256
  
  adc8361c120f88c1dd36f0069eefde0397a5f6d115a25f36beeac2da45826b77
- SHA512
  
  c9b6276ad2a4abaefb2c12ad98db5ac31d59a22988d7ff73df61a3e5d640349ccf11466f2cf23cf2d528506926c41323ba64b60727ec23b0f24a08b273ff1e9a
- SSDEEP
  
  6144:/pW2bgbbV28okoS1oWMkdlZQ5iinNrv26FYLIcw/3SclShdYylF4vx:/pW2IoioS6p/ShdYy+x
Score

10^/10

defense_evasion discovery evasion exploit persistence trojan
- UAC bypass
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Event Triggered Execution

Change Default File Association

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

File and Directory Permissions Modification

Windows File and Directory Permissions Modification

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexploitpersistencetrojan

behavioral2

defense_evasiondiscoveryevasionexploitpersistencetrojan