Overview

overview

9

Static

static

cd896cb355...42.exe

windows7-x64

9

cd896cb355...42.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd896cb355ab84a63513fc3a1779ace778bd79aef863b3056b03a84ee9494342

  • Size

    17KB

  • Sample

    221123-veqs2sbg4y

  • MD5

    534714bd88a6d97ec5f67ce676774cda

  • SHA1

    954a3465bd08e444f32af2b7a3dc76794276201e

  • SHA256

    cd896cb355ab84a63513fc3a1779ace778bd79aef863b3056b03a84ee9494342

  • SHA512

    7161d004755289a94198ab8059762b658530dd877884374b076405d87afa5b38c9851621058661dbd88a94c43d107a78a834b90e1ba851df89f5aaa04d40882a

  • SSDEEP

    384:VkE0bvmH4ciu1VNipbNtCGyFfmHUfzL+:5+mH4Ru7sTIb+sa

Score
9/10
persistenceupx

Malware Config

Targets

    • Target

      cd896cb355ab84a63513fc3a1779ace778bd79aef863b3056b03a84ee9494342

    • Size

      17KB

    • MD5

      534714bd88a6d97ec5f67ce676774cda

    • SHA1

      954a3465bd08e444f32af2b7a3dc76794276201e

    • SHA256

      cd896cb355ab84a63513fc3a1779ace778bd79aef863b3056b03a84ee9494342

    • SHA512

      7161d004755289a94198ab8059762b658530dd877884374b076405d87afa5b38c9851621058661dbd88a94c43d107a78a834b90e1ba851df89f5aaa04d40882a

    • SSDEEP

      384:VkE0bvmH4ciu1VNipbNtCGyFfmHUfzL+:5+mH4Ru7sTIb+sa

    Score
    9/10
    persistenceupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks