Overview

overview

9

Static

static

5a79eba3f9...e5.exe

windows7_x64

9

5a79eba3f9...e5.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5a79eba3f9e0e2ab3982c4512195f3f9e4b7b7f56b8993cfff69dfb47567bbe5

  • Size

    3.1MB

  • Sample

    201109-z1xyhg6ccn

  • MD5

    51c65f4486f9c76e90e3cde6a29f552d

  • SHA1

    cef1e7f6317a2f49836b9012c6396a7765516b6d

  • SHA256

    5a79eba3f9e0e2ab3982c4512195f3f9e4b7b7f56b8993cfff69dfb47567bbe5

  • SHA512

    49b3336b62a41facafa6aa37bffa1f467bab8ff5effc4eede9966baa7fcfba613a2b51f979d9fce324324fa76f8d664fde83cf609996e9436f9b4c0d0a28a824

Score
9/10
discoveryexploitpersistenceupx

Malware Config

Targets

    • Target

      5a79eba3f9e0e2ab3982c4512195f3f9e4b7b7f56b8993cfff69dfb47567bbe5

    • Size

      3.1MB

    • MD5

      51c65f4486f9c76e90e3cde6a29f552d

    • SHA1

      cef1e7f6317a2f49836b9012c6396a7765516b6d

    • SHA256

      5a79eba3f9e0e2ab3982c4512195f3f9e4b7b7f56b8993cfff69dfb47567bbe5

    • SHA512

      49b3336b62a41facafa6aa37bffa1f467bab8ff5effc4eede9966baa7fcfba613a2b51f979d9fce324324fa76f8d664fde83cf609996e9436f9b4c0d0a28a824

    Score
    9/10
    discoveryexploitpersistenceupx

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies RDP port number used by Windows

    • Possible privilege escalation attempt

      exploit

    • Sets DLL path for service in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

1
T1098

Registry Run Keys / Startup Folder

1
T1060

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

File Permissions Modification

1
T1222

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

1
T1076

Collection

Exfiltration

Command and Control

Impact

Tasks