Overview

overview

10

Static

static

8

272814c560...f5.exe

windows7-x64

10

272814c560...f5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    272814c560ea55ac1342374ce63994dbfbd260435446a32ef29af9150c4dfcf5

  • Size

    148KB

  • Sample

    221019-rjx65sbcb9

  • MD5

    bbf21d1be1cd5afee3f1ac3e54920413

  • SHA1

    508e9fe4250ca784b135a9dddc71295b8ba14c1e

  • SHA256

    272814c560ea55ac1342374ce63994dbfbd260435446a32ef29af9150c4dfcf5

  • SHA512

    1fa6b5d1c0a67099fbc22b35d7451308bd77bd5b273f147b1351a87c84e38a453b61cc9de8848d2b72920702645060f9c6d3ace25abba1c16d5ee4a08bbde2d3

  • SSDEEP

    3072:WKjntrgpq7EB8Plv02Ms8Zy4ZSptu8gJq3L1iEfVfl:WKjt1jc2MpR8Kq7YEH

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      272814c560ea55ac1342374ce63994dbfbd260435446a32ef29af9150c4dfcf5

    • Size

      148KB

    • MD5

      bbf21d1be1cd5afee3f1ac3e54920413

    • SHA1

      508e9fe4250ca784b135a9dddc71295b8ba14c1e

    • SHA256

      272814c560ea55ac1342374ce63994dbfbd260435446a32ef29af9150c4dfcf5

    • SHA512

      1fa6b5d1c0a67099fbc22b35d7451308bd77bd5b273f147b1351a87c84e38a453b61cc9de8848d2b72920702645060f9c6d3ace25abba1c16d5ee4a08bbde2d3

    • SSDEEP

      3072:WKjntrgpq7EB8Plv02Ms8Zy4ZSptu8gJq3L1iEfVfl:WKjt1jc2MpR8Kq7YEH

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies system executable filetype association

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Disables use of System Restore points

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks