60c73b767a7c748be246b9c8edf19922e361f961fde414cdaa20f05933ef983e | Triage

Sharing

General

Target

Client1.exe
Size

75KB
Sample

250328-nbgbwavwdy
MD5

aaa9a1048accb362dff125208ceee259
SHA1

c155cd8763879f4bd22345275d3f4e804683293d
SHA256

60c73b767a7c748be246b9c8edf19922e361f961fde414cdaa20f05933ef983e
SHA512

294ed8482f7f8f670c635f25c299e567357a60f64c7daebcafc2b19c157cffc43d6f448747c5fae8c0865c55916d2f85d4ab3ec7d82a79bd2b99425f754260a1
SSDEEP

1536:e0nZz1Ir/ZLtez0RtrnXw6cIASbtLEmfcHQ5pqKmY7:e0AeQnXrASbtQqDiz

Score

10^/10

defense_evasion persistence trojan

Malware Config

Targets

- Target
  
  Client1.exe
- Size
  
  75KB
- MD5
  
  aaa9a1048accb362dff125208ceee259
- SHA1
  
  c155cd8763879f4bd22345275d3f4e804683293d
- SHA256
  
  60c73b767a7c748be246b9c8edf19922e361f961fde414cdaa20f05933ef983e
- SHA512
  
  294ed8482f7f8f670c635f25c299e567357a60f64c7daebcafc2b19c157cffc43d6f448747c5fae8c0865c55916d2f85d4ab3ec7d82a79bd2b99425f754260a1
- SSDEEP
  
  1536:e0nZz1Ir/ZLtez0RtrnXw6cIASbtLEmfcHQ5pqKmY7:e0AeQnXrASbtQqDiz
Score

10^/10

persistence defense_evasion trojan
- Modifies WinLogon for persistence
  persistence
- Windows security bypass
  defense_evasion trojan
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

defense_evasionpersistencetrojan