4f3b70bc516eea31e7dcea41641a655a5b1b6ef110e7e57e8cf6ad9044f03dfb | Triage

Submit
Reports

Overview

overview

Static

static

8

4f3b70bc51...fb.exe

windows7-x64

4f3b70bc51...fb.exe

windows10-2004-x64

Sharing

General

Target

4f3b70bc516eea31e7dcea41641a655a5b1b6ef110e7e57e8cf6ad9044f03dfb
Size

624KB
Sample

221124-beftasgg86
MD5

258ede4f329b11d7bca0d1c138d56757
SHA1

bb697f049324387fb35e389077c633cbda339837
SHA256

4f3b70bc516eea31e7dcea41641a655a5b1b6ef110e7e57e8cf6ad9044f03dfb
SHA512

b87244b41bb9309d8e7dc3f7b11c939e6ef05d5fa3bdda063a613cb499d0713aea82cd64e31e5a9e79edbf715915280c79d5aa1416c7d391b1b0616885810af1
SSDEEP

6144:dVY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bco2KWz:dgDhdkq5BCoC5LfWSLTUQpr2Zu19Q3z

Score

10^/10

evasion persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

4f3b70bc516eea31e7dcea41641a655a5b1b6ef110e7e57e8cf6ad9044f03dfb.exe

Resource

win7-20220901-en

evasion persistence upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

4f3b70bc516eea31e7dcea41641a655a5b1b6ef110e7e57e8cf6ad9044f03dfb.exe

Resource

win10v2004-20221111-en

evasion persistence upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  4f3b70bc516eea31e7dcea41641a655a5b1b6ef110e7e57e8cf6ad9044f03dfb
- Size
  
  624KB
- MD5
  
  258ede4f329b11d7bca0d1c138d56757
- SHA1
  
  bb697f049324387fb35e389077c633cbda339837
- SHA256
  
  4f3b70bc516eea31e7dcea41641a655a5b1b6ef110e7e57e8cf6ad9044f03dfb
- SHA512
  
  b87244b41bb9309d8e7dc3f7b11c939e6ef05d5fa3bdda063a613cb499d0713aea82cd64e31e5a9e79edbf715915280c79d5aa1416c7d391b1b0616885810af1
- SSDEEP
  
  6144:dVY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bco2KWz:dgDhdkq5BCoC5LfWSLTUQpr2Zu19Q3z
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2024

Terms | Privacy