Overview

overview

10

Static

static

3

86c700ff84...1f.exe

windows7-x64

10

86c700ff84...1f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    86c700ff84fc68ebdf2edc8eea4a6f1f

  • Size

    368KB

  • Sample

    240201-nj9ndseafq

  • MD5

    86c700ff84fc68ebdf2edc8eea4a6f1f

  • SHA1

    2972c2ac9b51c58bf6661cad7232233f0da1e4b7

  • SHA256

    44a3f3ddc8a324f51924c9fbe67e144b28bd20c9a783b4baadc5f8b4ddf51e5e

  • SHA512

    1e0bd43743d2994a78712163dcbe280cf06552fc6a024debc33f6687dbfee0d940afbb93905ba6e6c3933f28c1476bda912565f7a496e626ebd0c323bd6a919f

  • SSDEEP

    6144:z7OSgRuehAjP4WN52HTqjNdSnd3l7VW6910/9NqXl3mnUULoKe5:bgRuehAjP4WN52HTqjNdSd3lc691MIlm

Score
10/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      86c700ff84fc68ebdf2edc8eea4a6f1f

    • Size

      368KB

    • MD5

      86c700ff84fc68ebdf2edc8eea4a6f1f

    • SHA1

      2972c2ac9b51c58bf6661cad7232233f0da1e4b7

    • SHA256

      44a3f3ddc8a324f51924c9fbe67e144b28bd20c9a783b4baadc5f8b4ddf51e5e

    • SHA512

      1e0bd43743d2994a78712163dcbe280cf06552fc6a024debc33f6687dbfee0d940afbb93905ba6e6c3933f28c1476bda912565f7a496e626ebd0c323bd6a919f

    • SSDEEP

      6144:z7OSgRuehAjP4WN52HTqjNdSnd3l7VW6910/9NqXl3mnUULoKe5:bgRuehAjP4WN52HTqjNdSd3lc691MIlm

    Score
    10/10
    evasionpersistencetrojanupx

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Modifies WinLogon

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Defense Evasion

Modify Registry

5
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks