d6fa27a87367e5b7b60a3d47f5f492456a118fc0896ce470293ce3d28f6ef4d4 | Triage

Submit
Reports

Overview

overview

Static

static

8

d6fa27a873...d4.exe

windows7-x64

d6fa27a873...d4.exe

windows10-2004-x64

Sharing

General

Target

d6fa27a87367e5b7b60a3d47f5f492456a118fc0896ce470293ce3d28f6ef4d4
Size

284KB
Sample

221121-td2y9agd93
MD5

193405676d996ea5dbb5442293f2a0d6
SHA1

6a38ba3d2c4356b718cae935fc97bd423a3e0d2f
SHA256

d6fa27a87367e5b7b60a3d47f5f492456a118fc0896ce470293ce3d28f6ef4d4
SHA512

33a25f42c2d028a5ce8c53537064e94d569873e65c3b4faa102eed29a0a6bea9cc0e437d7b22a333661e86028b55d9b93c00c3d24003c6615b1878d5bde320f7
SSDEEP

6144:auMJWY+qaHEQCcYfSBYJbQCjRcqESEgm6Anhc1kG6EmRzx:a+YcUc6SBLLTSEgBAnhc1kGsx

Score

10^/10

evasion persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

d6fa27a87367e5b7b60a3d47f5f492456a118fc0896ce470293ce3d28f6ef4d4.exe

Resource

win7-20221111-en

evasion persistence upx

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

d6fa27a87367e5b7b60a3d47f5f492456a118fc0896ce470293ce3d28f6ef4d4.exe

Resource

win10v2004-20221111-en

evasion persistence upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  d6fa27a87367e5b7b60a3d47f5f492456a118fc0896ce470293ce3d28f6ef4d4
- Size
  
  284KB
- MD5
  
  193405676d996ea5dbb5442293f2a0d6
- SHA1
  
  6a38ba3d2c4356b718cae935fc97bd423a3e0d2f
- SHA256
  
  d6fa27a87367e5b7b60a3d47f5f492456a118fc0896ce470293ce3d28f6ef4d4
- SHA512
  
  33a25f42c2d028a5ce8c53537064e94d569873e65c3b4faa102eed29a0a6bea9cc0e437d7b22a333661e86028b55d9b93c00c3d24003c6615b1878d5bde320f7
- SSDEEP
  
  6144:auMJWY+qaHEQCcYfSBYJbQCjRcqESEgm6Anhc1kG6EmRzx:a+YcUc6SBLLTSEgBAnhc1kGsx
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy