f0dc475c412a10fc3bf241268f4ffdd4e4cfbc5bf528fd10d9cb18184f96c572 | Triage

Submit
Reports

Overview

overview

Static

static

8

f0dc475c41...72.exe

windows7-x64

f0dc475c41...72.exe

windows10-2004-x64

Sharing

General

Target

f0dc475c412a10fc3bf241268f4ffdd4e4cfbc5bf528fd10d9cb18184f96c572
Size

491KB
Sample

221124-jt2nbada9s
MD5

c8df7d1e6133ea903d8fbfe61f2f2d66
SHA1

849325c414e11f29f2997ce0b66c5e041ab9f2f0
SHA256

f0dc475c412a10fc3bf241268f4ffdd4e4cfbc5bf528fd10d9cb18184f96c572
SHA512

6bfb043cb3916193b2af83e06035820c7be7fd46ed774474923268bef9907c702eea183d89475766f0db141d1383711102bf23356a38ca6d787a516939918bc6
SSDEEP

6144:5uHOU/UOPSe570Szp3b/UOPSe570Szp3irG1VVE+Ih/UOPSe570Szp3Znmy+g4H:gOjOB0vOB0JupOB062

Score

10^/10

evasion persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f0dc475c412a10fc3bf241268f4ffdd4e4cfbc5bf528fd10d9cb18184f96c572.exe

Resource

win7-20221111-en

evasion persistence upx

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

f0dc475c412a10fc3bf241268f4ffdd4e4cfbc5bf528fd10d9cb18184f96c572.exe

Resource

win10v2004-20221111-en

evasion persistence upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  f0dc475c412a10fc3bf241268f4ffdd4e4cfbc5bf528fd10d9cb18184f96c572
- Size
  
  491KB
- MD5
  
  c8df7d1e6133ea903d8fbfe61f2f2d66
- SHA1
  
  849325c414e11f29f2997ce0b66c5e041ab9f2f0
- SHA256
  
  f0dc475c412a10fc3bf241268f4ffdd4e4cfbc5bf528fd10d9cb18184f96c572
- SHA512
  
  6bfb043cb3916193b2af83e06035820c7be7fd46ed774474923268bef9907c702eea183d89475766f0db141d1383711102bf23356a38ca6d787a516939918bc6
- SSDEEP
  
  6144:5uHOU/UOPSe570Szp3b/UOPSe570Szp3irG1VVE+Ih/UOPSe570Szp3Znmy+g4H:gOjOB0vOB0JupOB062
Score

10^/10

evasion persistence upx
- Modifies visibility of file extensions in Explorer
  evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2024

Terms | Privacy