2887fe7c889be9a0b7e9c44106ac6d70b954fdca13561439262b53efb2f3f82c | Triage

Submit
Reports

Overview

overview

Static

static

8

2887fe7c88...2c.exe

windows7-x64

2887fe7c88...2c.exe

windows10-2004-x64

Sharing

General

Target

2887fe7c889be9a0b7e9c44106ac6d70b954fdca13561439262b53efb2f3f82c
Size

340KB
Sample

221123-zv7tqadh65
MD5

56f5172e2398598ad4b0dc19c8989b40
SHA1

0b5a7f9f03631a0533fcce094dd4bbdb1ccf278e
SHA256

2887fe7c889be9a0b7e9c44106ac6d70b954fdca13561439262b53efb2f3f82c
SHA512

74a202d0eb45c581f28f1a9ebb8db208c1ad415da2bac89e1095fb109d20e44f8e5b818ef2ca9fe8662d34614d00bee7bb1a5bd2c48c0061c342eae9bc97abe1
SSDEEP

6144:WuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qL54e+Wm5:d6Wq4aaE6KwyF5L0Y2D1PqLv+Wm5

Score

10^/10

evasion persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2887fe7c889be9a0b7e9c44106ac6d70b954fdca13561439262b53efb2f3f82c.exe

Resource

win7-20220812-en

evasion persistence trojan upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

2887fe7c889be9a0b7e9c44106ac6d70b954fdca13561439262b53efb2f3f82c.exe

Resource

win10v2004-20221111-en

evasion persistence trojan upx

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  2887fe7c889be9a0b7e9c44106ac6d70b954fdca13561439262b53efb2f3f82c
- Size
  
  340KB
- MD5
  
  56f5172e2398598ad4b0dc19c8989b40
- SHA1
  
  0b5a7f9f03631a0533fcce094dd4bbdb1ccf278e
- SHA256
  
  2887fe7c889be9a0b7e9c44106ac6d70b954fdca13561439262b53efb2f3f82c
- SHA512
  
  74a202d0eb45c581f28f1a9ebb8db208c1ad415da2bac89e1095fb109d20e44f8e5b818ef2ca9fe8662d34614d00bee7bb1a5bd2c48c0061c342eae9bc97abe1
- SSDEEP
  
  6144:WuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qL54e+Wm5:d6Wq4aaE6KwyF5L0Y2D1PqLv+Wm5
Score

10^/10

evasion persistence trojan upx
- UAC bypass
  evasion trojan
- Drops file in Drivers directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanupx

behavioral2

evasionpersistencetrojanupx

© 2018-2024

Terms | Privacy