caae72a918fd4ee10d71445a4d09355b116de4247b37159d1607d2bf5e49883b | Triage

Submit
Reports

Overview

overview

8

Static

static

8

caae72a918...3b.exe

windows7-x64

8

caae72a918...3b.exe

windows10-2004-x64

8

Sharing

General

Target

caae72a918fd4ee10d71445a4d09355b116de4247b37159d1607d2bf5e49883b
Size

419KB
Sample

221107-gasvysagc9
MD5

0c85f8e37afb7b1bf85ad3d38746ec90
SHA1

b725e2e59964812866eb92cfef09fe5bef3f6d93
SHA256

caae72a918fd4ee10d71445a4d09355b116de4247b37159d1607d2bf5e49883b
SHA512

e87e42c8664681d2b9d5abe899466486635ad6a799fd0632e43b4428a700d3cca45869b04a71f53c1bbf63b9411cab4a626b7b91773f7317e4cb489aa2451e53
SSDEEP

12288:1g2MA3Mw3Ewq/4QhSQTS7jb90EFwDviaPAm:F33v3EwVQmykqiaPP

Score

8^/10

evasion persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

caae72a918fd4ee10d71445a4d09355b116de4247b37159d1607d2bf5e49883b.exe

Resource

win7-20220901-en

evasion persistence upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

caae72a918fd4ee10d71445a4d09355b116de4247b37159d1607d2bf5e49883b.exe

Resource

win10v2004-20220812-en

evasion persistence upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  caae72a918fd4ee10d71445a4d09355b116de4247b37159d1607d2bf5e49883b
- Size
  
  419KB
- MD5
  
  0c85f8e37afb7b1bf85ad3d38746ec90
- SHA1
  
  b725e2e59964812866eb92cfef09fe5bef3f6d93
- SHA256
  
  caae72a918fd4ee10d71445a4d09355b116de4247b37159d1607d2bf5e49883b
- SHA512
  
  e87e42c8664681d2b9d5abe899466486635ad6a799fd0632e43b4428a700d3cca45869b04a71f53c1bbf63b9411cab4a626b7b91773f7317e4cb489aa2451e53
- SSDEEP
  
  12288:1g2MA3Mw3Ewq/4QhSQTS7jb90EFwDviaPAm:F33v3EwVQmykqiaPP
Score

8^/10

evasion persistence upx
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy