0672f13398e67c43c7157c82ebc12bab.exe
General
Target
Size
Sample
0672f13398e67c43c7157c82ebc12bab.exe
1MB
220120-x4dk5abcd6
Score
10 /10
MD5
SHA1
SHA256
SHA512
0672f13398e67c43c7157c82ebc12bab
7d0f4d5a05767f7ef534d7b05c72d5498918597d
93d7032a2106ff7bfe17dd46bf426aea166fdb883b37f377e2818f1882e494b1
3be366a7b80fc25a4569fef8361174b391b3fa01f9eed4039094a083ce9dc69a265b5041c9da2b9fd736cfd2af540ca0c51a5e70a3bbdb0fce2a076eefb57a5a
Malware Config
Targets
Target
MD5
Filesize
0672f13398e67c43c7157c82ebc12bab.exe
0672f13398e67c43c7157c82ebc12bab
1MB
Score
10/10
SHA1
SHA256
SHA512
7d0f4d5a05767f7ef534d7b05c72d5498918597d
93d7032a2106ff7bfe17dd46bf426aea166fdb883b37f377e2818f1882e494b1
3be366a7b80fc25a4569fef8361174b391b3fa01f9eed4039094a083ce9dc69a265b5041c9da2b9fd736cfd2af540ca0c51a5e70a3bbdb0fce2a076eefb57a5a
Tags
Signatures
-
Modifies Windows Defender Real-time Protection settings
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Tags
TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE
-
UPX packed file
Description
Detects executables packed with UPX/modified UPX open source packer.
Tags
-
Checks BIOS information in registry
Description
BIOS information is often read in order to detect sandboxing environments.
TTPs
-
Loads dropped DLL
-
Themida packer
Description
Detects Themida, an advanced Windows software protection system.
Tags
-
Adds Run key to start application
Tags
TTPs
-
Checks whether UAC is enabled
Tags
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Tasks