Overview

overview

10

Static

static

7

4d54a66058...ef.exe

windows7-x64

10

4d54a66058...ef.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d54a66058ea3a0431ebb452b153f1ef

  • Size

    139KB

  • Sample

    240109-e2t6zsfdcr

  • MD5

    4d54a66058ea3a0431ebb452b153f1ef

  • SHA1

    ad84dd360a54cddf3c193b107a77036590698a95

  • SHA256

    cee058c4c7585c0c68a5c539d8dd048444721f3d0d02e9bce6077dd7c226c1c8

  • SHA512

    d01a4eaf5c22e1ac2525d82e30c12cc79174a2f3f04a5c39de41d29897fea51cb0b5eac48e70f4d900af1716dc347c1dfc9d4610c976a5e8f960355a6f0e6131

  • SSDEEP

    3072:mxWqPmyFTG1UH55L+37rrgiYP/oX7DotGLhDYxWn:mxWizFTGyH6X8e7zhsxW

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      4d54a66058ea3a0431ebb452b153f1ef

    • Size

      139KB

    • MD5

      4d54a66058ea3a0431ebb452b153f1ef

    • SHA1

      ad84dd360a54cddf3c193b107a77036590698a95

    • SHA256

      cee058c4c7585c0c68a5c539d8dd048444721f3d0d02e9bce6077dd7c226c1c8

    • SHA512

      d01a4eaf5c22e1ac2525d82e30c12cc79174a2f3f04a5c39de41d29897fea51cb0b5eac48e70f4d900af1716dc347c1dfc9d4610c976a5e8f960355a6f0e6131

    • SSDEEP

      3072:mxWqPmyFTG1UH55L+37rrgiYP/oX7DotGLhDYxWn:mxWizFTGyH6X8e7zhsxW

    Score
    10/10
    persistenceupx

    • Modifies WinLogon for persistence

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks