Overview

overview

8

Static

static

92b7082229...1f.exe

windows7-x64

8

92b7082229...1f.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92b708222922ab33f2ed89bfda8c4fc71fda996896d2e816708adf0f27fed11f

  • Size

    141KB

  • Sample

    221129-fzsqtahc97

  • MD5

    e030ff10bd3693b025b36fb2a6923d44

  • SHA1

    3ce3feef6fd20089d6b24cb7920368064f22f220

  • SHA256

    92b708222922ab33f2ed89bfda8c4fc71fda996896d2e816708adf0f27fed11f

  • SHA512

    65bc61f6f2ea9ef9cfcaebc7602063246983536eda00a3d86046a6d78b85f050e035b451d88adf1b6b4059aa48d035bbdfabc8e37ed27c63c0487ba6aad43792

  • SSDEEP

    3072:4flOchKvRfVBs9fi57z/gaseA8Sl0Wmacf:4HhqRfV6iBDselV9f

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      92b708222922ab33f2ed89bfda8c4fc71fda996896d2e816708adf0f27fed11f

    • Size

      141KB

    • MD5

      e030ff10bd3693b025b36fb2a6923d44

    • SHA1

      3ce3feef6fd20089d6b24cb7920368064f22f220

    • SHA256

      92b708222922ab33f2ed89bfda8c4fc71fda996896d2e816708adf0f27fed11f

    • SHA512

      65bc61f6f2ea9ef9cfcaebc7602063246983536eda00a3d86046a6d78b85f050e035b451d88adf1b6b4059aa48d035bbdfabc8e37ed27c63c0487ba6aad43792

    • SSDEEP

      3072:4flOchKvRfVBs9fi57z/gaseA8Sl0Wmacf:4HhqRfV6iBDselV9f

    Score
    8/10
    persistencevmprotect

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks