Overview

overview

10

Static

static

7

76045a9a88...94.exe

windows7-x64

10

76045a9a88...94.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76045a9a88df63f1fe5189f0924ce094

  • Size

    410KB

  • Sample

    231226-ryeckshcf8

  • MD5

    76045a9a88df63f1fe5189f0924ce094

  • SHA1

    214399c6f31d29124e871009188d9b4c2e1080e7

  • SHA256

    7df2d122f80f8ba8f89b7447457d4637c2a89455466612c6fe021734a014531c

  • SHA512

    237e838e7938fd97da3719bc8656491484acab05628cbae95c8df89fa308647b4367d6f54515921c378827cd65b949ffaf6f23a0d10b8b316b25734b9435327c

  • SSDEEP

    12288:qnNhuBoY8SorxgmA+nlvVlXLydgyZPi8zkzD6XiV3:qPatCg7EPxed/1i8zO33

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      76045a9a88df63f1fe5189f0924ce094

    • Size

      410KB

    • MD5

      76045a9a88df63f1fe5189f0924ce094

    • SHA1

      214399c6f31d29124e871009188d9b4c2e1080e7

    • SHA256

      7df2d122f80f8ba8f89b7447457d4637c2a89455466612c6fe021734a014531c

    • SHA512

      237e838e7938fd97da3719bc8656491484acab05628cbae95c8df89fa308647b4367d6f54515921c378827cd65b949ffaf6f23a0d10b8b316b25734b9435327c

    • SSDEEP

      12288:qnNhuBoY8SorxgmA+nlvVlXLydgyZPi8zkzD6XiV3:qPatCg7EPxed/1i8zO33

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks