Overview

overview

10

Static

static

8

7b12e4caee...1e.exe

windows7-x64

10

7b12e4caee...1e.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e

  • Size

    722KB

  • Sample

    221202-a27pvsbd7z

  • MD5

    c006626e4fcbc675c911ba705fe60525

  • SHA1

    f8193cc8d62922eb726420ae4115e0766a1119d8

  • SHA256

    7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e

  • SHA512

    a1d84e0c99120b749275c0140a9cc9153ef4613703197f622d500d08ee9b8eb9c0e7a1e604091ad2713cf724659647bb92edcc20ab024825452431ef6ed74476

  • SSDEEP

    1536:2fRN2/SWANOttpVxXVIXKL7mxUH1OibPoQT9lnouy8:EOAKnrq6Oxo1OcRJ9out

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e

    • Size

      722KB

    • MD5

      c006626e4fcbc675c911ba705fe60525

    • SHA1

      f8193cc8d62922eb726420ae4115e0766a1119d8

    • SHA256

      7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e

    • SHA512

      a1d84e0c99120b749275c0140a9cc9153ef4613703197f622d500d08ee9b8eb9c0e7a1e604091ad2713cf724659647bb92edcc20ab024825452431ef6ed74476

    • SSDEEP

      1536:2fRN2/SWANOttpVxXVIXKL7mxUH1OibPoQT9lnouy8:EOAKnrq6Oxo1OcRJ9out

    Score
    10/10
    evasionpersistencespywarestealertrojanupx

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks