Overview

overview

8

Static

static

8

7c5c2c879e...33.exe

windows7-x64

8

7c5c2c879e...33.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c5c2c879e48ab54334bf8112873849a712755a6665b32b459ba5c01895d2833

  • Size

    374KB

  • Sample

    221123-2d11yshf56

  • MD5

    2682e23b8da8814b33f39ef445c6d604

  • SHA1

    e01f9e0fd70bab85a5a9bc324b096faaef939685

  • SHA256

    7c5c2c879e48ab54334bf8112873849a712755a6665b32b459ba5c01895d2833

  • SHA512

    80faf60951dad363900d7f3f2d12ac0923cf52e4fc9e72dc4a658db18db98c5a3d6ddc0d16ca65a068a388c5d7fc9b4bda5f2e3fe64f46cb74a4a9cde321e079

  • SSDEEP

    6144:viQI6y6jdpdIyo3t73T4eVRHgcXo4DwwhA0Qhp9TS1LYHpbJ:vPXFIyM7MkScY4/hA3h3JF

Score
8/10
discoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      7c5c2c879e48ab54334bf8112873849a712755a6665b32b459ba5c01895d2833

    • Size

      374KB

    • MD5

      2682e23b8da8814b33f39ef445c6d604

    • SHA1

      e01f9e0fd70bab85a5a9bc324b096faaef939685

    • SHA256

      7c5c2c879e48ab54334bf8112873849a712755a6665b32b459ba5c01895d2833

    • SHA512

      80faf60951dad363900d7f3f2d12ac0923cf52e4fc9e72dc4a658db18db98c5a3d6ddc0d16ca65a068a388c5d7fc9b4bda5f2e3fe64f46cb74a4a9cde321e079

    • SSDEEP

      6144:viQI6y6jdpdIyo3t73T4eVRHgcXo4DwwhA0Qhp9TS1LYHpbJ:vPXFIyM7MkScY4/hA3h3JF

    Score
    8/10
    discoveryevasionpersistencetrojanupx

    • Adds policy Run key to start application

      persistence

    • Drops file in Drivers directory

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks