Overview

overview

10

Static

static

8

042f4770df...ae.exe

windows7-x64

10

042f4770df...ae.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    042f4770df820a5b612ff52dc82018ea77b43196956e14e05a54ae5b210b0aae

  • Size

    428KB

  • Sample

    221128-rh9tjsdg5s

  • MD5

    136069469d5ee41acb76ae4ee236983d

  • SHA1

    a67c181f4855327a8f399bbd7fefec03cac73d88

  • SHA256

    042f4770df820a5b612ff52dc82018ea77b43196956e14e05a54ae5b210b0aae

  • SHA512

    e6034c8075683f1a459b5cdb9ace0f767ffd8eb7ba55bbcadac4c0b4d6f17f1eead2d334fcd0c4d93cb09a1a9add86568bc8b32b9a998237027363daf404788c

  • SSDEEP

    6144:5uHOU/UOPSe570Szp38l+lXDZJfLufs73dOk0XDpNjNOpys8mnmy+g4+nmy+g4H:gOjOB0heZJys73dOvXDpNjNe8mt2

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      042f4770df820a5b612ff52dc82018ea77b43196956e14e05a54ae5b210b0aae

    • Size

      428KB

    • MD5

      136069469d5ee41acb76ae4ee236983d

    • SHA1

      a67c181f4855327a8f399bbd7fefec03cac73d88

    • SHA256

      042f4770df820a5b612ff52dc82018ea77b43196956e14e05a54ae5b210b0aae

    • SHA512

      e6034c8075683f1a459b5cdb9ace0f767ffd8eb7ba55bbcadac4c0b4d6f17f1eead2d334fcd0c4d93cb09a1a9add86568bc8b32b9a998237027363daf404788c

    • SSDEEP

      6144:5uHOU/UOPSe570Szp38l+lXDZJfLufs73dOk0XDpNjNOpys8mnmy+g4+nmy+g4H:gOjOB0heZJys73dOvXDpNjNe8mt2

    Score
    10/10
    evasionpersistenceupx

    • Modifies visibility of file extensions in Explorer

      evasion

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks