Overview

overview

10

Static

static

8

3181065099...58.exe

windows7_x64

10

3181065099...58.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3181065099986c2bb8b3f58f04f2c59e5bd5887dc46f6e7c9a62ba7d2ca23758

  • Size

    917KB

  • Sample

    220129-xvq5vsfhgk

  • MD5

    27790c50a6ddc9b4835973f33d1d5371

  • SHA1

    b3af32050b7e243ad623c318899695b717bedb07

  • SHA256

    3181065099986c2bb8b3f58f04f2c59e5bd5887dc46f6e7c9a62ba7d2ca23758

  • SHA512

    0edbddf4f8e541e7292301de34e5277e63a66240450435c1dc5389005092a4b50f892cd895934ce54e78b6bb4604d2941404f592883f7c2768272a36075b8313

Score
10/10
evasionlinkpdfpersistenceupx

Malware Config

Targets

    • Target

      3181065099986c2bb8b3f58f04f2c59e5bd5887dc46f6e7c9a62ba7d2ca23758

    • Size

      917KB

    • MD5

      27790c50a6ddc9b4835973f33d1d5371

    • SHA1

      b3af32050b7e243ad623c318899695b717bedb07

    • SHA256

      3181065099986c2bb8b3f58f04f2c59e5bd5887dc46f6e7c9a62ba7d2ca23758

    • SHA512

      0edbddf4f8e541e7292301de34e5277e63a66240450435c1dc5389005092a4b50f892cd895934ce54e78b6bb4604d2941404f592883f7c2768272a36075b8313

    Score
    10/10
    evasionlinkpdfpersistenceupx

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

5
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks