33f724ecd22180a0884ff53a77fc3a41aad0d777f7af899644b2b75d0f1baffc | Triage

Sharing

General

Target

33f724ecd22180a0884ff53a77fc3a41aad0d777f7af899644b2b75d0f1baffc
Size

740KB
Sample

220919-r68amadeb3
MD5

4d2bb9f5f130681c00050a46b60b1762
SHA1

08921f6a73a5f6a1edb543a1774ab5d95c4cd4a5
SHA256

33f724ecd22180a0884ff53a77fc3a41aad0d777f7af899644b2b75d0f1baffc
SHA512

f09a5f8fe7ade189f73edefb0c4e78e894590b44d1ec8b821fb2c48cbaf74186c475d64848ac8415d146ae9dce3f78a8138dcf9fdaa8d998ed25582aee14b9ee
SSDEEP

12288:cWwsKgyig/fFtxPB6WNv4sMh9HVTETcGUiMk1Af2ztivgrtlQ11TrH9lLxZpqRSy:cVgZgHFXPB6WZZMhxBETx9e8tivgrtlx

Score

10^/10

discovery exploit persistence upx

Malware Config

Targets

- Target
  
  33f724ecd22180a0884ff53a77fc3a41aad0d777f7af899644b2b75d0f1baffc
- Size
  
  740KB
- MD5
  
  4d2bb9f5f130681c00050a46b60b1762
- SHA1
  
  08921f6a73a5f6a1edb543a1774ab5d95c4cd4a5
- SHA256
  
  33f724ecd22180a0884ff53a77fc3a41aad0d777f7af899644b2b75d0f1baffc
- SHA512
  
  f09a5f8fe7ade189f73edefb0c4e78e894590b44d1ec8b821fb2c48cbaf74186c475d64848ac8415d146ae9dce3f78a8138dcf9fdaa8d998ed25582aee14b9ee
- SSDEEP
  
  12288:cWwsKgyig/fFtxPB6WNv4sMh9HVTETcGUiMk1Af2ztivgrtlQ11TrH9lLxZpqRSy:cVgZgHFXPB6WZZMhxBETx9e8tivgrtlx
Score

10^/10

discovery exploit persistence upx
- Modifies WinLogon for persistence
  persistence
- Possible privilege escalation attempt
  exploit
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Process Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexploitpersistenceupx

behavioral2

discoveryexploitpersistenceupx