Overview

overview

10

Static

static

3

TradingVie...r .exe

windows10-2004-x64

10

TradingVie...r .exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    15c5209905b69c0c3fc0321ff375ed07bc0a60ea1a4bcae8eefbb4c9c7153c00
  • Size 1.4MB
  • Sample260423-dvbwdshx71
  • SHA256 15c5209905b69c0c3fc0321ff375ed07bc0a60ea1a4bcae8eefbb4c9c7153c00
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionevasionpersistencetrojan

Malware Config

Targets

    • Target
      TradingView Installer .exe
    • Size 101.6MB
    • SHA256 c210dbc29f8e68c0b1e1a3812a9b7bdb0af369436c03a07ae0eb10143b2f75a0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionevasionpersistencetrojan

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies Windows Defender TamperProtection settings

      evasiontrojan

    • Modifies Windows Defender notification settings

      defense_evasiontrojan

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Executes dropped EXE

    • Windows security modification

      defense_evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks