7b51e398909cf727773a2df8ed60b9c745162e5ca76d75c02fa47f95264abd1e | Triage

Resubmissions

27-01-2025 15:13

250127-sl5vfavpal 10

27-01-2025 15:12

250127-sk86gavnen 6

Sharing

General

Target

sample
Size

270KB
Sample

250127-sl5vfavpal
MD5

14d0e35dad1a914432d7c9220131939a
SHA1

87228fa78626dc81e5b3ed54f588d38cfdabb62b
SHA256

7b51e398909cf727773a2df8ed60b9c745162e5ca76d75c02fa47f95264abd1e
SHA512

747ae792790b2dcbcbc85c6d4d2b05ff0dbfb363ccc177d3dbbf316eda323be053045e81c10fab59f1c60c4a2a484cfa4a9a2a3fbc314237ae8515753b7129cd
SSDEEP

3072:c9GkOIZ7aCZZtoIwwLlFpRA+JejzpzrxAF4IrwiAwtN+25/j4w6:c9GkOy7aCZZ2Iw8pRNipzrrI8K4w6

Score

10^/10

microsoft defense_evasion discovery persistence phishing trojan

Malware Config

Targets

- Target
  
  sample
- Size
  
  270KB
- MD5
  
  14d0e35dad1a914432d7c9220131939a
- SHA1
  
  87228fa78626dc81e5b3ed54f588d38cfdabb62b
- SHA256
  
  7b51e398909cf727773a2df8ed60b9c745162e5ca76d75c02fa47f95264abd1e
- SHA512
  
  747ae792790b2dcbcbc85c6d4d2b05ff0dbfb363ccc177d3dbbf316eda323be053045e81c10fab59f1c60c4a2a484cfa4a9a2a3fbc314237ae8515753b7129cd
- SSDEEP
  
  3072:c9GkOIZ7aCZZtoIwwLlFpRA+JejzpzrxAF4IrwiAwtN+25/j4w6:c9GkOy7aCZZ2Iw8pRNipzrrI8K4w6
Score

10^/10

microsoft defense_evasion discovery persistence phishing trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Detected potential entity reuse from brand MICROSOFT.
  phishing microsoft
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

microsoftdefense_evasiondiscoverypersistencephishingtrojan