Overview

overview

10

Static

static

e894aaa26f...ed.exe

windows7_x64

10

e894aaa26f...ed.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e894aaa26f75cc07ecdee02a0ed31f666382ef51efe6ed41bac5e77ac3b4d9ed

  • Size

    165KB

  • Sample

    210504-wtare3rhyn

  • MD5

    1d4c7f58efd6e23432387e97427a2507

  • SHA1

    b0c0d9e1a3ed3d2001df17c584134f557e0f4743

  • SHA256

    e894aaa26f75cc07ecdee02a0ed31f666382ef51efe6ed41bac5e77ac3b4d9ed

  • SHA512

    c1cef0a1d39f417e3373dd41bdbaf3e1ce4ff569357c43bba73beb48bbc8e37fb716523cbde1fdab3f80db328fe358481da846e7c10a629ee67da7ddcd2ebc40

Score
10/10
evasiontrojanupx

Malware Config

Targets

    • Target

      e894aaa26f75cc07ecdee02a0ed31f666382ef51efe6ed41bac5e77ac3b4d9ed

    • Size

      165KB

    • MD5

      1d4c7f58efd6e23432387e97427a2507

    • SHA1

      b0c0d9e1a3ed3d2001df17c584134f557e0f4743

    • SHA256

      e894aaa26f75cc07ecdee02a0ed31f666382ef51efe6ed41bac5e77ac3b4d9ed

    • SHA512

      c1cef0a1d39f417e3373dd41bdbaf3e1ce4ff569357c43bba73beb48bbc8e37fb716523cbde1fdab3f80db328fe358481da846e7c10a629ee67da7ddcd2ebc40

    Score
    10/10
    evasiontrojanupx

    • Modifies firewall policy service

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

5
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks