87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb | Triage

Submit
Reports

Overview

overview

Static

static

8

87baaf5877...cb.exe

windows7-x64

87baaf5877...cb.exe

windows10-2004-x64

Sharing

General

Target

87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb
Size

255KB
Sample

221123-zv2mpsdh57
MD5

8f1e3fe00745836a1d9446e7c5bccd1d
SHA1

fdf9d4553100bc347287d3a187c8277a5c04b2d3
SHA256

87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb
SHA512

7ba041ad463153089d1d3690be6a015e8210c29bdfc8ac913f4ed7457f4bb89b544c0f93b12b73da1e2231150f0f3a8fbaff2e030ed1a2f4664bde28117d35d0
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJS:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3

Score

10^/10

evasion persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe

Resource

win7-20221111-en

evasion persistence trojan upx

windows7-x64

24 signatures

150 seconds

Behavioral task

behavioral2

Sample

87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe

Resource

win10v2004-20221111-en

evasion persistence trojan upx

windows10-2004-x64

25 signatures

150 seconds

Malware Config

Targets

- Target
  
  87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb
- Size
  
  255KB
- MD5
  
  8f1e3fe00745836a1d9446e7c5bccd1d
- SHA1
  
  fdf9d4553100bc347287d3a187c8277a5c04b2d3
- SHA256
  
  87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb
- SHA512
  
  7ba041ad463153089d1d3690be6a015e8210c29bdfc8ac913f4ed7457f4bb89b544c0f93b12b73da1e2231150f0f3a8fbaff2e030ed1a2f4664bde28117d35d0
- SSDEEP
  
  3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJS:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3
Score

10^/10

evasion persistence trojan upx
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanupx

behavioral2

evasionpersistencetrojanupx

© 2018-2024

Terms | Privacy