Overview

overview

10

Static

static

8

aa7a2ca669...26.exe

windows7-x64

10

aa7a2ca669...26.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26

  • Size

    380KB

  • Sample

    221123-hnv3xaeb57

  • MD5

    91dc7d7c0608c2e76a59704c7ad83b7c

  • SHA1

    9fe75c22fef8caa144765406df4a83d279290c4e

  • SHA256

    aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26

  • SHA512

    b9763fabd191e9690fa84883ce0fdce7748c6b6f1981ae761cd978d6253e8af6cfe40fe9ae7636757591332e208b1e0ba5f077fa5b789c71f946d46fbb4a7e02

  • SSDEEP

    6144:Uzv+kSZBbdH19ex4T02J4fqz22tvymTiB62iKnWKKmDTcNwjreOwI+Tm1T8vbp:UzcRD02J4Sq2vHGB67KWKKmDWKSp

Score
10/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26

    • Size

      380KB

    • MD5

      91dc7d7c0608c2e76a59704c7ad83b7c

    • SHA1

      9fe75c22fef8caa144765406df4a83d279290c4e

    • SHA256

      aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26

    • SHA512

      b9763fabd191e9690fa84883ce0fdce7748c6b6f1981ae761cd978d6253e8af6cfe40fe9ae7636757591332e208b1e0ba5f077fa5b789c71f946d46fbb4a7e02

    • SSDEEP

      6144:Uzv+kSZBbdH19ex4T02J4fqz22tvymTiB62iKnWKKmDTcNwjreOwI+Tm1T8vbp:UzcRD02J4Sq2vHGB67KWKKmDWKSp

    Score
    10/10
    evasionpersistencetrojanupx

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops startup file

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

4
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks