Overview

overview

8

Static

static

7

045dc8058c...03.exe

windows7-x64

8

045dc8058c...03.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    045dc8058cb94c3ad1ed194ef99f8c03

  • Size

    5.0MB

  • Sample

    231229-z8wcvadbfm

  • MD5

    045dc8058cb94c3ad1ed194ef99f8c03

  • SHA1

    40ca603cafc0e1900dd4b71b1b6c3e9beafcff99

  • SHA256

    9c94c0ed0fbd1d5f998b0987b20943ed38b020ca01fd6014fda8020bad2b256f

  • SHA512

    64a2ffcc82946c7bc4050de703ffa7ebdf0239a7d50a67465b3b55864a0f1b843a7337669e28e18bc5e3c2ddc1acb7c141691148e999e518027571f305aad426

  • SSDEEP

    98304:Q6qoaYIlQ2M5cYE6o6ySrmfvh7t+c8vpYTUfdv3LyXTcri:Q6sZo5cYRoVvRt+Rh0CdvbyX

Score
8/10
evasionpersistencethemida

Malware Config

Targets

    • Target

      045dc8058cb94c3ad1ed194ef99f8c03

    • Size

      5.0MB

    • MD5

      045dc8058cb94c3ad1ed194ef99f8c03

    • SHA1

      40ca603cafc0e1900dd4b71b1b6c3e9beafcff99

    • SHA256

      9c94c0ed0fbd1d5f998b0987b20943ed38b020ca01fd6014fda8020bad2b256f

    • SHA512

      64a2ffcc82946c7bc4050de703ffa7ebdf0239a7d50a67465b3b55864a0f1b843a7337669e28e18bc5e3c2ddc1acb7c141691148e999e518027571f305aad426

    • SSDEEP

      98304:Q6qoaYIlQ2M5cYE6o6ySrmfvh7t+c8vpYTUfdv3LyXTcri:Q6sZo5cYRoVvRt+Rh0CdvbyX

    Score
    8/10
    evasionpersistencethemida

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasion

    • Uses Session Manager for persistence

      Creates Session Manager registry key to run executable early in system boot.

      persistence

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks