Overview

overview

8

Static

static

1

36e76b05dd...28.exe

windows7-x64

8

36e76b05dd...28.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    36e76b05dd89ddbe6e5f6bac4a97e1523dff88b9529e08f2a331c36fe7c84828

  • Size

    1.4MB

  • Sample

    231124-sk5haada6y

  • MD5

    99508b3085c7d2e2b225f73a292ab41d

  • SHA1

    79972639a8d1265f137a553c0abe2ccdf12f95b4

  • SHA256

    36e76b05dd89ddbe6e5f6bac4a97e1523dff88b9529e08f2a331c36fe7c84828

  • SHA512

    abc8bad30e36d9773806e658db54b98bffd26ce49b7242397b30f74344dab202bb725452e87c58001f5419137c64cfa366e5cd8d26dfda21c0e02a72d57bafa7

  • SSDEEP

    24576:LVv/8oS4TnYBZ/J1KBDkDIamRigrWKZ0QFEwyaLWeslqcNbBNvEh2dmTTrEH7k:1/FSIcZrKB4DIRrWi0GExWWec9bjshGk

Score
8/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      36e76b05dd89ddbe6e5f6bac4a97e1523dff88b9529e08f2a331c36fe7c84828

    • Size

      1.4MB

    • MD5

      99508b3085c7d2e2b225f73a292ab41d

    • SHA1

      79972639a8d1265f137a553c0abe2ccdf12f95b4

    • SHA256

      36e76b05dd89ddbe6e5f6bac4a97e1523dff88b9529e08f2a331c36fe7c84828

    • SHA512

      abc8bad30e36d9773806e658db54b98bffd26ce49b7242397b30f74344dab202bb725452e87c58001f5419137c64cfa366e5cd8d26dfda21c0e02a72d57bafa7

    • SSDEEP

      24576:LVv/8oS4TnYBZ/J1KBDkDIamRigrWKZ0QFEwyaLWeslqcNbBNvEh2dmTTrEH7k:1/FSIcZrKB4DIRrWi0GExWWec9bjshGk

    Score
    8/10
    discoverypersistenceupx

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks