Overview

overview

8

Static

static

9a6bc6983b...21.exe

windows7_x64

8

9a6bc6983b...21.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9a6bc6983b7ed3000ae4d406f7b6d421

  • Size

    6.5MB

  • Sample

    201117-3q6efagfd2

  • MD5

    b8b7aa546a2913ac0a1acd632951ac18

  • SHA1

    5fe622b5b66b79c812fd498a67a9ccd055b489bf

  • SHA256

    7b737f462fb4afa04e0c1e1cd518a46c485fb5f6a39dd7f71207475f07a3e51c

  • SHA512

    c2adc3c2d8487e44fecfa51de3f51e657a066e1d26fd966f903618c07fcecfb12b5e5a988fc2210eaaca76e6837bcb17ee4050fff8a4289150c5b9cef955f383

Score
8/10
discoveryupx

Malware Config

Targets

    • Target

      9a6bc6983b7ed3000ae4d406f7b6d421

    • Size

      6.5MB

    • MD5

      b8b7aa546a2913ac0a1acd632951ac18

    • SHA1

      5fe622b5b66b79c812fd498a67a9ccd055b489bf

    • SHA256

      7b737f462fb4afa04e0c1e1cd518a46c485fb5f6a39dd7f71207475f07a3e51c

    • SHA512

      c2adc3c2d8487e44fecfa51de3f51e657a066e1d26fd966f903618c07fcecfb12b5e5a988fc2210eaaca76e6837bcb17ee4050fff8a4289150c5b9cef955f383

    Score
    8/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks