Overview

overview

10

Static

static

a7f435a5a4...eb.exe

windows7-x64

10

a7f435a5a4...eb.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a7f435a5a41d55c9f26be452afb5b8c25293f7c46f098eae3e42bd4ea9e70feb

  • Size

    255KB

  • Sample

    221127-zdcx1sbh5z

  • MD5

    fd97a38a85c52065de9c73b242cf67d3

  • SHA1

    27c2a215eff1b36230fd250bb06717eb7f8df174

  • SHA256

    a7f435a5a41d55c9f26be452afb5b8c25293f7c46f098eae3e42bd4ea9e70feb

  • SHA512

    dd47f2ff92d552ac70f441de9bd76b54c182ebdb78a1320ff4f15d921fc15ddd52c04606c9b6566097d56b0515535d6e8cdc1a55181c71b3ebf2919b3a105ca8

  • SSDEEP

    6144:dNq76Mm3cCvrNaX7/4R640r9LIHHyYKUt:dsFmJzVRsrhIy7Ut

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      a7f435a5a41d55c9f26be452afb5b8c25293f7c46f098eae3e42bd4ea9e70feb

    • Size

      255KB

    • MD5

      fd97a38a85c52065de9c73b242cf67d3

    • SHA1

      27c2a215eff1b36230fd250bb06717eb7f8df174

    • SHA256

      a7f435a5a41d55c9f26be452afb5b8c25293f7c46f098eae3e42bd4ea9e70feb

    • SHA512

      dd47f2ff92d552ac70f441de9bd76b54c182ebdb78a1320ff4f15d921fc15ddd52c04606c9b6566097d56b0515535d6e8cdc1a55181c71b3ebf2919b3a105ca8

    • SSDEEP

      6144:dNq76Mm3cCvrNaX7/4R640r9LIHHyYKUt:dsFmJzVRsrhIy7Ut

    Score
    10/10
    evasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks