2136efb6967841815f0917d6bc791e9d4796822fcac20f7feb6831b370d31543 | Triage

Submit
Reports

Overview

overview

Static

static

8

2136efb696...43.exe

windows7-x64

2136efb696...43.exe

windows10-2004-x64

Sharing

General

Target

2136efb6967841815f0917d6bc791e9d4796822fcac20f7feb6831b370d31543
Size

252KB
Sample

221030-kfcygaccfq
MD5

85166cbfde3ea8b97854ba6832000696
SHA1

489e057da7c536ca1ae4d7e3ca32b66f919c703c
SHA256

2136efb6967841815f0917d6bc791e9d4796822fcac20f7feb6831b370d31543
SHA512

dd9958c29272b969e79748227dea383dcb959b3fe7b0d41ec831e58709df4e55eefa4497ecc44ae88731fd6036b6c5a4fc6490e3a541856b862cce93ee821408
SSDEEP

3072:B51kljkliKj1FZTmsijT7ejdag5GnTJUBxm1gYQANES7gujbWt0iUEQUjFOLpeO6:31wkbei/5GTJU4gY3LEuPU0D6O1lIz

Score

10^/10

evasion persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2136efb6967841815f0917d6bc791e9d4796822fcac20f7feb6831b370d31543.exe

Resource

win7-20220812-en

evasion persistence upx

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

2136efb6967841815f0917d6bc791e9d4796822fcac20f7feb6831b370d31543.exe

Resource

win10v2004-20220812-en

evasion persistence upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  2136efb6967841815f0917d6bc791e9d4796822fcac20f7feb6831b370d31543
- Size
  
  252KB
- MD5
  
  85166cbfde3ea8b97854ba6832000696
- SHA1
  
  489e057da7c536ca1ae4d7e3ca32b66f919c703c
- SHA256
  
  2136efb6967841815f0917d6bc791e9d4796822fcac20f7feb6831b370d31543
- SHA512
  
  dd9958c29272b969e79748227dea383dcb959b3fe7b0d41ec831e58709df4e55eefa4497ecc44ae88731fd6036b6c5a4fc6490e3a541856b862cce93ee821408
- SSDEEP
  
  3072:B51kljkliKj1FZTmsijT7ejdag5GnTJUBxm1gYQANES7gujbWt0iUEQUjFOLpeO6:31wkbei/5GTJU4gY3LEuPU0D6O1lIz
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy