Overview

overview

10

Static

static

8

a1d1538863...17.exe

windows7-x64

10

a1d1538863...17.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1d1538863f592bf7e90674bae4f3882de36ea3c95e2663589fd1219e56cb917

  • Size

    634KB

  • Sample

    221127-whqg5abe61

  • MD5

    d0b7650e2b5c2af6ccb342c705c48bd8

  • SHA1

    1d8aa9b2fbfc651addc0274d71d4d1dffd88727f

  • SHA256

    a1d1538863f592bf7e90674bae4f3882de36ea3c95e2663589fd1219e56cb917

  • SHA512

    34b39b05d064210b5de6bb08a5233998b2e3c2c40593d7aa9d050b755f3f80b81187ff0c727bc207c60a318cb5302797a224f5078574db80eb78638dd22e5f4a

  • SSDEEP

    6144:5uHOFgnmy+g4yuHOFgnmy+g4euHOFgnmy+g4yuHOFgnmy+g4/:gOFgGOFgIOFgGOFg6

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      a1d1538863f592bf7e90674bae4f3882de36ea3c95e2663589fd1219e56cb917

    • Size

      634KB

    • MD5

      d0b7650e2b5c2af6ccb342c705c48bd8

    • SHA1

      1d8aa9b2fbfc651addc0274d71d4d1dffd88727f

    • SHA256

      a1d1538863f592bf7e90674bae4f3882de36ea3c95e2663589fd1219e56cb917

    • SHA512

      34b39b05d064210b5de6bb08a5233998b2e3c2c40593d7aa9d050b755f3f80b81187ff0c727bc207c60a318cb5302797a224f5078574db80eb78638dd22e5f4a

    • SSDEEP

      6144:5uHOFgnmy+g4yuHOFgnmy+g4euHOFgnmy+g4yuHOFgnmy+g4/:gOFgGOFgIOFgGOFg6

    Score
    10/10
    evasionpersistenceupx

    • Modifies visibility of file extensions in Explorer

      evasion

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks