Overview

overview

10

Static

static

7491aff492...55.exe

windows7-x64

10

7491aff492...55.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7491aff492e44379e3a6b3bacc23978177649c28a7c30c4dcffe2d6d1432b655

  • Size

    680KB

  • Sample

    221205-29bqyafh44

  • MD5

    9715432d2caa10733530d2d0eb0b2b35

  • SHA1

    19cf8b134c8213031346cd14e3a10754a0a49096

  • SHA256

    7491aff492e44379e3a6b3bacc23978177649c28a7c30c4dcffe2d6d1432b655

  • SHA512

    647a3ec3e288b0c99a7160a08086bb1dbbc83e3b27303b055f6a4f0392048222dfb00a43c8eef28b945b690a6b0ca39f13f400244ef862b851f213f6cba7a032

  • SSDEEP

    12288:0ClephVMo7IYJAB++2RrxRAjbeNC2v+clES+vYOqH:BOhKpYyB/MrxRAZMES+b+

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      7491aff492e44379e3a6b3bacc23978177649c28a7c30c4dcffe2d6d1432b655

    • Size

      680KB

    • MD5

      9715432d2caa10733530d2d0eb0b2b35

    • SHA1

      19cf8b134c8213031346cd14e3a10754a0a49096

    • SHA256

      7491aff492e44379e3a6b3bacc23978177649c28a7c30c4dcffe2d6d1432b655

    • SHA512

      647a3ec3e288b0c99a7160a08086bb1dbbc83e3b27303b055f6a4f0392048222dfb00a43c8eef28b945b690a6b0ca39f13f400244ef862b851f213f6cba7a032

    • SSDEEP

      12288:0ClephVMo7IYJAB++2RrxRAjbeNC2v+clES+vYOqH:BOhKpYyB/MrxRAZMES+b+

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks