e6b8e3e3afe5b8a273176c7538102f7a6e7bdb72879393e9b398220b075afc25 | Triage

Sharing

General

Target

e6b8e3e3afe5b8a273176c7538102f7a6e7bdb72879393e9b398220b075afc25
Size

550KB
Sample

241028-gw454szmcl
MD5

ef66bc948ca5ff1bd4e76191adc11b0a
SHA1

d1fb64af325b0cfaa165869d8fcafea672849fd3
SHA256

e6b8e3e3afe5b8a273176c7538102f7a6e7bdb72879393e9b398220b075afc25
SHA512

914de2b160d607dfb87c19e52006c4c3724f8d96f7a7ae7d31d1219539745fc73a77e2484cc23459f33b16ee16f8356356380f759988e15dddbe5fd707b905d8
SSDEEP

6144:/pW2bgbbV28okoS1oWMkdlZQ5iinNrv26FYLIcw/3Scg1IReqYKztp0YcAvq:/pW2IoioS6p8IReqYKztp0YTvq

Score

10^/10

defense_evasion discovery evasion exploit persistence trojan

Malware Config

Targets

- Target
  
  e6b8e3e3afe5b8a273176c7538102f7a6e7bdb72879393e9b398220b075afc25
- Size
  
  550KB
- MD5
  
  ef66bc948ca5ff1bd4e76191adc11b0a
- SHA1
  
  d1fb64af325b0cfaa165869d8fcafea672849fd3
- SHA256
  
  e6b8e3e3afe5b8a273176c7538102f7a6e7bdb72879393e9b398220b075afc25
- SHA512
  
  914de2b160d607dfb87c19e52006c4c3724f8d96f7a7ae7d31d1219539745fc73a77e2484cc23459f33b16ee16f8356356380f759988e15dddbe5fd707b905d8
- SSDEEP
  
  6144:/pW2bgbbV28okoS1oWMkdlZQ5iinNrv26FYLIcw/3Scg1IReqYKztp0YcAvq:/pW2IoioS6p8IReqYKztp0YTvq
Score

10^/10

defense_evasion discovery evasion exploit persistence trojan
- UAC bypass
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Event Triggered Execution

Change Default File Association

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

File and Directory Permissions Modification

Windows File and Directory Permissions Modification

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexploitpersistencetrojan

behavioral2

defense_evasiondiscoveryevasionexploitpersistencetrojan