Overview

overview

10

Static

static

8

d66c690e67...d3.exe

windows7-x64

10

d66c690e67...d3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d66c690e67f55e68f1b1a05037d78ea02dc2cc16879adf4fcb3e1ae6392d75d3

  • Size

    398KB

  • Sample

    221002-te4jgafaem

  • MD5

    6fc485db03eddbe362f781e0dd3628f7

  • SHA1

    1d6d0d9fb16a156292856ee0c12841eda27ec10f

  • SHA256

    d66c690e67f55e68f1b1a05037d78ea02dc2cc16879adf4fcb3e1ae6392d75d3

  • SHA512

    ce57c2f975436cb0071a3f98f7f927b60da25dae496695e7b8a32b753aeddf2f05042a76af11dfe8d5225af8be3ff2cca3b8f60503606943582f778db124a32a

  • SSDEEP

    6144:uYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO0BHvbFyA3:uSNC80I+cR3R03VseuOiHvgA3

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      d66c690e67f55e68f1b1a05037d78ea02dc2cc16879adf4fcb3e1ae6392d75d3

    • Size

      398KB

    • MD5

      6fc485db03eddbe362f781e0dd3628f7

    • SHA1

      1d6d0d9fb16a156292856ee0c12841eda27ec10f

    • SHA256

      d66c690e67f55e68f1b1a05037d78ea02dc2cc16879adf4fcb3e1ae6392d75d3

    • SHA512

      ce57c2f975436cb0071a3f98f7f927b60da25dae496695e7b8a32b753aeddf2f05042a76af11dfe8d5225af8be3ff2cca3b8f60503606943582f778db124a32a

    • SSDEEP

      6144:uYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO0BHvbFyA3:uSNC80I+cR3R03VseuOiHvgA3

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks