Overview

overview

10

Static

static

8

78503764f7...90.exe

windows7-x64

10

78503764f7...90.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    78503764f7906f592910697087ae6bdcc7850e8b9ec79bff78ae406d23a88b90

  • Size

    288KB

  • Sample

    221204-a995ysgc6v

  • MD5

    19a7beb8ce93d318cf6f5af484960e10

  • SHA1

    8b297c1976659666eb68208cf71afe537b37adc9

  • SHA256

    78503764f7906f592910697087ae6bdcc7850e8b9ec79bff78ae406d23a88b90

  • SHA512

    be9e1684fc85c53555c57f4644de40ff42263cfdbf1164fb43f1f47de14e739990fd078180e1f960cb12bebbfa727db938f32e4374a3bca9885c7541697552e9

  • SSDEEP

    6144:6YZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UOV7Khx0H:6SNC80I+cR3R03VseuOVw6

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      78503764f7906f592910697087ae6bdcc7850e8b9ec79bff78ae406d23a88b90

    • Size

      288KB

    • MD5

      19a7beb8ce93d318cf6f5af484960e10

    • SHA1

      8b297c1976659666eb68208cf71afe537b37adc9

    • SHA256

      78503764f7906f592910697087ae6bdcc7850e8b9ec79bff78ae406d23a88b90

    • SHA512

      be9e1684fc85c53555c57f4644de40ff42263cfdbf1164fb43f1f47de14e739990fd078180e1f960cb12bebbfa727db938f32e4374a3bca9885c7541697552e9

    • SSDEEP

      6144:6YZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UOV7Khx0H:6SNC80I+cR3R03VseuOVw6

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks