43c6e0c78fafc024abb4685eaf0e271267a212acc339cd58624367007c617069 | Triage

Submit
Reports

Overview

overview

Static

static

8

43c6e0c78f...69.exe

windows7-x64

43c6e0c78f...69.exe

windows10-2004-x64

Sharing

General

Target

43c6e0c78fafc024abb4685eaf0e271267a212acc339cd58624367007c617069
Size

781KB
Sample

221124-l29d8sfd55
MD5

6b099793ae2c3cd4287626318b30cace
SHA1

a93fd76626bf06a64c1d76257638c269a42a0f3c
SHA256

43c6e0c78fafc024abb4685eaf0e271267a212acc339cd58624367007c617069
SHA512

1c8aae718e485bb3f39f41a93b02b28b758e773a00dd326f9d3cd2e3e87a996d497ceaeb3acbea0cb44b01275cc1e10830ad72d76695336b254fb6b1052d2b45
SSDEEP

6144:5uHOcGFrQZb++tdsHP4+QfI6U9/UOPSe570Szp3Znmy+g46nmy+g4VLG/UOPSe56:gOcerQZb+md4w1UWOB06V6LpOB0H

Score

10^/10

evasion persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

43c6e0c78fafc024abb4685eaf0e271267a212acc339cd58624367007c617069.exe

Resource

win7-20221111-en

evasion persistence upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

43c6e0c78fafc024abb4685eaf0e271267a212acc339cd58624367007c617069.exe

Resource

win10v2004-20221111-en

evasion persistence upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  43c6e0c78fafc024abb4685eaf0e271267a212acc339cd58624367007c617069
- Size
  
  781KB
- MD5
  
  6b099793ae2c3cd4287626318b30cace
- SHA1
  
  a93fd76626bf06a64c1d76257638c269a42a0f3c
- SHA256
  
  43c6e0c78fafc024abb4685eaf0e271267a212acc339cd58624367007c617069
- SHA512
  
  1c8aae718e485bb3f39f41a93b02b28b758e773a00dd326f9d3cd2e3e87a996d497ceaeb3acbea0cb44b01275cc1e10830ad72d76695336b254fb6b1052d2b45
- SSDEEP
  
  6144:5uHOcGFrQZb++tdsHP4+QfI6U9/UOPSe570Szp3Znmy+g46nmy+g4VLG/UOPSe56:gOcerQZb+md4w1UWOB06V6LpOB0H
Score

10^/10

evasion persistence upx
- Modifies visibility of file extensions in Explorer
  evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2024

Terms | Privacy