23ffcf846de87d8755d3d19b1b0994d3e5e5cc539883906954d8335177447a9b | Triage

Submit
Reports

Overview

overview

Static

static

23ffcf846d...9b.exe

windows7-x64

23ffcf846d...9b.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

Target

23ffcf846de87d8755d3d19b1b0994d3e5e5cc539883906954d8335177447a9b
Size

194KB
Sample

221206-zcmqtsea6s
MD5

f5c2679635fbf54936a99a1f82cfbb6c
SHA1

d2422bc9ab043a354ae18025745c2ee98705ee70
SHA256

23ffcf846de87d8755d3d19b1b0994d3e5e5cc539883906954d8335177447a9b
SHA512

490dec11b76653a667d8a73b2a191c8f53e2572cedbb86506ac9dee49431971b701a45180978eb05762e807ab5056fa80e41ff6deaa4d3f8a88e2b17ceb1c1bd
SSDEEP

3072:BOvgqTeaH8tYm2v3Idtnn2auPZl4Kw7XsvogV8w3LELLX5j0aLgYYDp:Zq66m2UJ2NPZaKu8wgV8w4XTrO

Score

10^/10

evasion persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

23ffcf846de87d8755d3d19b1b0994d3e5e5cc539883906954d8335177447a9b.exe

Resource

win7-20221111-en

evasion persistence trojan upx

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

23ffcf846de87d8755d3d19b1b0994d3e5e5cc539883906954d8335177447a9b.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  23ffcf846de87d8755d3d19b1b0994d3e5e5cc539883906954d8335177447a9b
- Size
  
  194KB
- MD5
  
  f5c2679635fbf54936a99a1f82cfbb6c
- SHA1
  
  d2422bc9ab043a354ae18025745c2ee98705ee70
- SHA256
  
  23ffcf846de87d8755d3d19b1b0994d3e5e5cc539883906954d8335177447a9b
- SHA512
  
  490dec11b76653a667d8a73b2a191c8f53e2572cedbb86506ac9dee49431971b701a45180978eb05762e807ab5056fa80e41ff6deaa4d3f8a88e2b17ceb1c1bd
- SSDEEP
  
  3072:BOvgqTeaH8tYm2v3Idtnn2auPZl4Kw7XsvogV8w3LELLX5j0aLgYYDp:Zq66m2UJ2NPZaKu8wgV8w4XTrO
Score

10^/10

evasion persistence trojan upx
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanupx

behavioral2

© 2018-2025

Terms | Privacy