Overview

overview

10

Static

static

8

a8fd8242fe...f9.exe

windows7-x64

10

a8fd8242fe...f9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a8fd8242feb2bffb3a76330c724d0d427c5d87f750a421fe93f7e6c502cb79f9

  • Size

    493KB

  • Sample

    221029-qkvlzagha3

  • MD5

    7cfed2e30e158be45faa5253d023b8e8

  • SHA1

    34553b8ee2138765e61ca7a7bbc2316e17fa6cd8

  • SHA256

    a8fd8242feb2bffb3a76330c724d0d427c5d87f750a421fe93f7e6c502cb79f9

  • SHA512

    fcf6f4aa9651a8119c4998aefcd85ca2d3a6b16c596a6ca3f55a7da406ce14f57e710ea46d9abbe347acc12188688ff8344f50aa8a88d2a2ef4d50d37dea74c4

  • SSDEEP

    12288:gOMeZJys73dOvXDpNjNe8NupOB0vyOB0H:OeZJ8NI8IOAyOM

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      a8fd8242feb2bffb3a76330c724d0d427c5d87f750a421fe93f7e6c502cb79f9

    • Size

      493KB

    • MD5

      7cfed2e30e158be45faa5253d023b8e8

    • SHA1

      34553b8ee2138765e61ca7a7bbc2316e17fa6cd8

    • SHA256

      a8fd8242feb2bffb3a76330c724d0d427c5d87f750a421fe93f7e6c502cb79f9

    • SHA512

      fcf6f4aa9651a8119c4998aefcd85ca2d3a6b16c596a6ca3f55a7da406ce14f57e710ea46d9abbe347acc12188688ff8344f50aa8a88d2a2ef4d50d37dea74c4

    • SSDEEP

      12288:gOMeZJys73dOvXDpNjNe8NupOB0vyOB0H:OeZJ8NI8IOAyOM

    Score
    10/10
    evasionpersistenceupx

    • Modifies visibility of file extensions in Explorer

      evasion

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks