31211a3a138ee3f441b20e2404d3d66046867e1dcdbd074477568743629ae318 | Triage

Submit
Reports

Overview

overview

Static

static

8

31211a3a13...18.exe

windows7-x64

31211a3a13...18.exe

windows10-2004-x64

Sharing

General

Target

31211a3a138ee3f441b20e2404d3d66046867e1dcdbd074477568743629ae318
Size

5.7MB
Sample

221124-avqg1aaf4y
MD5

26734945831cfa3d3e14ea9b0e19bbf2
SHA1

05d4dbac55989c5378ca6baf6eb9a2159c7dbc31
SHA256

31211a3a138ee3f441b20e2404d3d66046867e1dcdbd074477568743629ae318
SHA512

85143d1fd6a5037642eaccb5bd0dfbda19873fcf01293c6dccc55cd36ed59358f0452129a2eebfef6745e127630e9545957db0dd6e6d5aa1609ea112f2dcc117
SSDEEP

98304:i0qh0r0q2wf02GzMwDws0q40q0qC0FwwRZHwNwYwx0qJ0nwQ0Z0q/Npww2ewl0q0:i7effIPEsy58doQaTxLhQyZbIly38do/

Score

10^/10

adware persistence stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

31211a3a138ee3f441b20e2404d3d66046867e1dcdbd074477568743629ae318.exe

Resource

win7-20220812-en

adware persistence stealer upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

31211a3a138ee3f441b20e2404d3d66046867e1dcdbd074477568743629ae318.exe

Resource

win10v2004-20220812-en

adware persistence stealer upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  31211a3a138ee3f441b20e2404d3d66046867e1dcdbd074477568743629ae318
- Size
  
  5.7MB
- MD5
  
  26734945831cfa3d3e14ea9b0e19bbf2
- SHA1
  
  05d4dbac55989c5378ca6baf6eb9a2159c7dbc31
- SHA256
  
  31211a3a138ee3f441b20e2404d3d66046867e1dcdbd074477568743629ae318
- SHA512
  
  85143d1fd6a5037642eaccb5bd0dfbda19873fcf01293c6dccc55cd36ed59358f0452129a2eebfef6745e127630e9545957db0dd6e6d5aa1609ea112f2dcc117
- SSDEEP
  
  98304:i0qh0r0q2wf02GzMwDws0q40q0qC0FwwRZHwNwYwx0qJ0nwQ0Z0q/Npww2ewl0q0:i7effIPEsy58doQaTxLhQyZbIly38do/
Score

10^/10

adware persistence stealer upx
- Modifies WinLogon for persistence
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarepersistencestealerupx

behavioral2

adwarepersistencestealerupx

© 2018-2024

Terms | Privacy