Overview

overview

8

Static

static

1

52d91320bb..._1.mp4

windows7-x64

52d91320bb..._1.mp4

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target

    52d91320bbdd4193b31cc40ca262f419b2a00462058b0223703d5f3bd8c5d6a0_1.mp4

  • Size

    2.6MB

  • Sample

    240128-mzyemabaar

  • MD5

    47fc80f80e956249816302ed4e4680a7

  • SHA1

    c15b49d079b4f53d2f7d902820e9005616f29c56

  • SHA256

    add32fe09b9f043df843e7b19d7ca62ec61204aaa2c94355022768889ae699c5

  • SHA512

    950aeeaff509e29a073c0f667453b80c730a624392b1f00a75ec309355493c7fc3732b208861f023eee4753a99084a133d63719a76fc242874515a7807b51c2d

  • SSDEEP

    49152:zeUH0uWzg/jFJb+hqDqJkcA/9qkikB5sGTDp/dtkOl:zHH0uWC5Jb+hqDqicsiksGTDp/x

Score
8/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      52d91320bbdd4193b31cc40ca262f419b2a00462058b0223703d5f3bd8c5d6a0_1.mp4

    • Size

      2.6MB

    • MD5

      47fc80f80e956249816302ed4e4680a7

    • SHA1

      c15b49d079b4f53d2f7d902820e9005616f29c56

    • SHA256

      add32fe09b9f043df843e7b19d7ca62ec61204aaa2c94355022768889ae699c5

    • SHA512

      950aeeaff509e29a073c0f667453b80c730a624392b1f00a75ec309355493c7fc3732b208861f023eee4753a99084a133d63719a76fc242874515a7807b51c2d

    • SSDEEP

      49152:zeUH0uWzg/jFJb+hqDqJkcA/9qkikB5sGTDp/dtkOl:zHH0uWC5Jb+hqDqicsiksGTDp/x

    Score
    8/10
    discoveryevasionpersistenceupx

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

2
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks