9eff38209ebd2bd8149a3a3a6a7c020bd77111add6fce2b51665a285016eded3 | Triage

Sharing

General

Target

Insta乗っ取り.exe
Size

12.8MB
Sample

241126-pm43ra1lf1
MD5

437af39cc8fedd934e7008716963d92d
SHA1

a72510965df65e6addc97f1bc4f8b13e32000407
SHA256

9eff38209ebd2bd8149a3a3a6a7c020bd77111add6fce2b51665a285016eded3
SHA512

da58e27c126dcc449587239a5bc4e9747f03b6c086deb766f5ed34f060c1f01578795e90e118e0e791c7ae82eaaf4048a3d5b895cd1abf19be0c2b415b19fc59
SSDEEP

393216:VM6vp8RbQDtSL0kkIyUQd0lnLKg2QFRC94Qik:VMBbQnJIYd0lnLNHCOY

Score

10^/10

defense_evasion discovery evasion execution exploit persistence trojan

Malware Config

Targets

- Target
  
  Insta乗っ取り.exe
- Size
  
  12.8MB
- MD5
  
  437af39cc8fedd934e7008716963d92d
- SHA1
  
  a72510965df65e6addc97f1bc4f8b13e32000407
- SHA256
  
  9eff38209ebd2bd8149a3a3a6a7c020bd77111add6fce2b51665a285016eded3
- SHA512
  
  da58e27c126dcc449587239a5bc4e9747f03b6c086deb766f5ed34f060c1f01578795e90e118e0e791c7ae82eaaf4048a3d5b895cd1abf19be0c2b415b19fc59
- SSDEEP
  
  393216:VM6vp8RbQDtSL0kkIyUQd0lnLKg2QFRC94Qik:VMBbQnJIYd0lnLNHCOY
Score

10^/10

defense_evasion discovery evasion execution exploit persistence trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Disables Task Manager via registry modification
  evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

File and Directory Permissions Modification

Windows File and Directory Permissions Modification

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutionexploitpersistencetrojan