12c22da9b6caf8f126c136c701cba472f29eea073ae5cdb05058594a4867b910 | Triage

Submit
Reports

Overview

overview

Static

static

8

12c22da9b6...10.exe

windows7-x64

12c22da9b6...10.exe

windows10-2004-x64

Sharing

General

Target

12c22da9b6caf8f126c136c701cba472f29eea073ae5cdb05058594a4867b910
Size

281KB
Sample

220919-zm2yhacfem
MD5

3c368a27739b0e4b5da28dd5ac7f56b9
SHA1

45b8bd8dffa565b277eef9c47baed6827f1f4a9d
SHA256

12c22da9b6caf8f126c136c701cba472f29eea073ae5cdb05058594a4867b910
SHA512

9de7897d9627c1d405a10d2e10e4ae60a1e7a9897698974fcb0bb08b73aac5a728a114b36225c2e2e20d974c640c24c40f72ea00ec7ed9ef7ec88bc74331d33f
SSDEEP

3072:HuHUJU+1l8nSCXOKcSZfuj014yxCAeEYs9a3nGtg0d50pnjdWsCbcNJL+HiI09uH:HuHIU3SCXOM31Gs48xmj0sFNJL+C0

Score

10^/10

evasion persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

12c22da9b6caf8f126c136c701cba472f29eea073ae5cdb05058594a4867b910.exe

Resource

win7-20220812-en

evasion persistence upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

12c22da9b6caf8f126c136c701cba472f29eea073ae5cdb05058594a4867b910.exe

Resource

win10v2004-20220812-en

evasion persistence upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  12c22da9b6caf8f126c136c701cba472f29eea073ae5cdb05058594a4867b910
- Size
  
  281KB
- MD5
  
  3c368a27739b0e4b5da28dd5ac7f56b9
- SHA1
  
  45b8bd8dffa565b277eef9c47baed6827f1f4a9d
- SHA256
  
  12c22da9b6caf8f126c136c701cba472f29eea073ae5cdb05058594a4867b910
- SHA512
  
  9de7897d9627c1d405a10d2e10e4ae60a1e7a9897698974fcb0bb08b73aac5a728a114b36225c2e2e20d974c640c24c40f72ea00ec7ed9ef7ec88bc74331d33f
- SSDEEP
  
  3072:HuHUJU+1l8nSCXOKcSZfuj014yxCAeEYs9a3nGtg0d50pnjdWsCbcNJL+HiI09uH:HuHIU3SCXOM31Gs48xmj0sFNJL+C0
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2024

Terms | Privacy