Overview

overview

8

Static

static

1

77f9015d29...02.exe

windows7-x64

8

77f9015d29...02.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    77f9015d295f702cad0036a9fd7dc01ef7769797286f3c9c46d3ed71e4047d02

  • Size

    192KB

  • Sample

    220919-p6acgsdeep

  • MD5

    79078652e272f139049a2981fad615f0

  • SHA1

    f47020d40cca1c605a7cb3006bad00b30521a2eb

  • SHA256

    77f9015d295f702cad0036a9fd7dc01ef7769797286f3c9c46d3ed71e4047d02

  • SHA512

    052b07640c78ea0c8c038127dde38ea73aa8c220dab086201c00c73c32efbad98b8784377effd8cf1a8832a9393b49f85ebe7b024d77e334344684668fb20862

  • SSDEEP

    3072:nbLpZuEskJoU4aNuWXiHFcvzIb0rGwYbNdYYEspo39i+bDhwIGfeu1mrsg:nbOOxPXiHYzFkNdYmpoZfhwbmuAog

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      77f9015d295f702cad0036a9fd7dc01ef7769797286f3c9c46d3ed71e4047d02

    • Size

      192KB

    • MD5

      79078652e272f139049a2981fad615f0

    • SHA1

      f47020d40cca1c605a7cb3006bad00b30521a2eb

    • SHA256

      77f9015d295f702cad0036a9fd7dc01ef7769797286f3c9c46d3ed71e4047d02

    • SHA512

      052b07640c78ea0c8c038127dde38ea73aa8c220dab086201c00c73c32efbad98b8784377effd8cf1a8832a9393b49f85ebe7b024d77e334344684668fb20862

    • SSDEEP

      3072:nbLpZuEskJoU4aNuWXiHFcvzIb0rGwYbNdYYEspo39i+bDhwIGfeu1mrsg:nbOOxPXiHYzFkNdYmpoZfhwbmuAog

    Score
    8/10
    persistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks