5c0d08c95aba7f1d0b0d4982586f3b87f61a9409c46a6c7cb4852b8377465f33 | Triage

Sharing

General

Target

EC250125AAACW-000025_document.exexx
Size

769KB
Sample

250328-bpbbkazygx
MD5

85241ab08bc17b08e08a721d25e85e99
SHA1

d975b17b2f499ef87f21fda034e5a8b64420b820
SHA256

5c0d08c95aba7f1d0b0d4982586f3b87f61a9409c46a6c7cb4852b8377465f33
SHA512

7586ab2d5ea88eab8bb9e39f76064bc7b1d9a6c3815a17da697bb89088399a97264e83f2c98128165c365be6c7f44a783182a7dd975fc26bf7b02c69c07a13c7
SSDEEP

12288:I2m7wrTR8+n9ath/W63Y4yYUHh4B/J/MvExZQYC3:I2Wm8+d4ypB4pZMv

Score

10^/10

defense_evasion evasion trojan

Malware Config

Targets

- Target
  
  EC250125AAACW-000025_document.exexx
- Size
  
  769KB
- MD5
  
  85241ab08bc17b08e08a721d25e85e99
- SHA1
  
  d975b17b2f499ef87f21fda034e5a8b64420b820
- SHA256
  
  5c0d08c95aba7f1d0b0d4982586f3b87f61a9409c46a6c7cb4852b8377465f33
- SHA512
  
  7586ab2d5ea88eab8bb9e39f76064bc7b1d9a6c3815a17da697bb89088399a97264e83f2c98128165c365be6c7f44a783182a7dd975fc26bf7b02c69c07a13c7
- SSDEEP
  
  12288:I2m7wrTR8+n9ath/W63Y4yYUHh4B/J/MvExZQYC3:I2Wm8+d4ypB4pZMv
Score

10^/10

defense_evasion evasion trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

defense_evasionevasiontrojan