40a114578300d3ea6aa9936db5837f2421f2aa48c613c64f9881a00722d7e2ac | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7245accbd55ed95f8e5e2018814b2d84
Size

369KB
Sample

240124-pyb64safa5
MD5

7245accbd55ed95f8e5e2018814b2d84
SHA1

d4216e44d50ce7beaa0025173e6c7af70f762361
SHA256

40a114578300d3ea6aa9936db5837f2421f2aa48c613c64f9881a00722d7e2ac
SHA512

ff61b5ce0b98eb98f845d36eb23d8409636799c27e3d6c6070e8a32b37836febb62ec83e8c73be398b22b94e35db34f9fa8396564446102e3aebe1691ed87188
SSDEEP

6144:AFw8wzBhaEUJ45mnkVym6trxrK4c5X4qXvy92pdWl7iNdRrtXkNmMG4LRUwYT2xK:AFszBhqS5mcytrhP6X4qa9Cw2NdRKNOn

Score

8^/10

evasion persistence upx

Malware Config

Targets

- Target
  
  7245accbd55ed95f8e5e2018814b2d84
- Size
  
  369KB
- MD5
  
  7245accbd55ed95f8e5e2018814b2d84
- SHA1
  
  d4216e44d50ce7beaa0025173e6c7af70f762361
- SHA256
  
  40a114578300d3ea6aa9936db5837f2421f2aa48c613c64f9881a00722d7e2ac
- SHA512
  
  ff61b5ce0b98eb98f845d36eb23d8409636799c27e3d6c6070e8a32b37836febb62ec83e8c73be398b22b94e35db34f9fa8396564446102e3aebe1691ed87188
- SSDEEP
  
  6144:AFw8wzBhaEUJ45mnkVym6trxrK4c5X4qXvy92pdWl7iNdRrtXkNmMG4LRUwYT2xK:AFszBhqS5mcytrhP6X4qa9Cw2NdRKNOn
Score

8^/10

evasion persistence upx
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx