Overview

overview

10

Static

static

6529259d32...2a.exe

windows7_x64

10

6529259d32...2a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6529259d321cd833140bc2cf29e1c5cf46064ea1a968fb440ee46fb939b7c02a

  • Size

    4.7MB

  • Sample

    201106-xgd1wpcyzj

  • MD5

    12d654c5509109fff4fc031b1236b0b2

  • SHA1

    a93f8ee55b794d66f2631101dc5ce65b39d4dd7a

  • SHA256

    6529259d321cd833140bc2cf29e1c5cf46064ea1a968fb440ee46fb939b7c02a

  • SHA512

    93cd5f08710ff5ab52713e53ae446af5e2b4bd2a1a6d0f3d7e006849daeea683811cd02334c63906a1c2ad64cc17874a51d8f4988c36b50f104bccc6acb240d9

Score
10/10
discoveryexploitpersistenceupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Targets

    • Target

      6529259d321cd833140bc2cf29e1c5cf46064ea1a968fb440ee46fb939b7c02a

    • Size

      4.7MB

    • MD5

      12d654c5509109fff4fc031b1236b0b2

    • SHA1

      a93f8ee55b794d66f2631101dc5ce65b39d4dd7a

    • SHA256

      6529259d321cd833140bc2cf29e1c5cf46064ea1a968fb440ee46fb939b7c02a

    • SHA512

      93cd5f08710ff5ab52713e53ae446af5e2b4bd2a1a6d0f3d7e006849daeea683811cd02334c63906a1c2ad64cc17874a51d8f4988c36b50f104bccc6acb240d9

    Score
    10/10
    discoveryexploitpersistenceupx

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Blacklisted process makes network request

    • Modifies RDP port number used by Windows

    • Possible privilege escalation attempt

      exploit

    • Sets DLL path for service in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

1
T1098

Registry Run Keys / Startup Folder

1
T1060

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

File Permissions Modification

1
T1222

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

1
T1076

Collection

Exfiltration

Command and Control

Impact

Tasks