Overview

overview

8

Static

static

8

ca29c95370...7b.exe

windows7-x64

8

ca29c95370...7b.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca29c95370adc8897660104db605b360ab953ad2330c6c336dfac3deb260147b

  • Size

    111KB

  • Sample

    221001-zjwbjseha6

  • MD5

    0a9dfe5f60f2c99508cacd9261b62b25

  • SHA1

    b89b32f1cbfb9d6040c00131d65fa3cd03a5ffa8

  • SHA256

    ca29c95370adc8897660104db605b360ab953ad2330c6c336dfac3deb260147b

  • SHA512

    348a259755b7107bb4f38198f0f3b35877587f603e9540774da9b11fbb5db58035fce9b8d2fae33109d452080fbb99b77980c1c3221d4991ea1942049d7ade8b

  • SSDEEP

    3072:u0v4Yb2eruGgAaeXWhTj+feuCL0ov7jG8Cy/ecX:Jvrb22uGLbWhTjYeuvgew

Score
8/10
microsoftpersistencephishingupx

Malware Config

Targets

    • Target

      ca29c95370adc8897660104db605b360ab953ad2330c6c336dfac3deb260147b

    • Size

      111KB

    • MD5

      0a9dfe5f60f2c99508cacd9261b62b25

    • SHA1

      b89b32f1cbfb9d6040c00131d65fa3cd03a5ffa8

    • SHA256

      ca29c95370adc8897660104db605b360ab953ad2330c6c336dfac3deb260147b

    • SHA512

      348a259755b7107bb4f38198f0f3b35877587f603e9540774da9b11fbb5db58035fce9b8d2fae33109d452080fbb99b77980c1c3221d4991ea1942049d7ade8b

    • SSDEEP

      3072:u0v4Yb2eruGgAaeXWhTj+feuCL0ov7jG8Cy/ecX:Jvrb22uGLbWhTjYeuvgew

    Score
    8/10
    persistenceupxmicrosoftphishing

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks