e3aaef1cf6d4ca0a0cfd557c0cf7f11ffebf04312d77fd51590ad2e6c275dc6e | Triage

Submit
Reports

Overview

overview

Static

static

e3aaef1cf6...6e.exe

windows7-x64

e3aaef1cf6...6e.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

e3aaef1cf6d4ca0a0cfd557c0cf7f11ffebf04312d77fd51590ad2e6c275dc6e
Size

63KB
Sample

240520-ee5n7sba9s
MD5

371164f87275c60b2e1451c46588ffee
SHA1

59975974d2aa2bf1cd9a8e325a2647dca1e5d3db
SHA256

e3aaef1cf6d4ca0a0cfd557c0cf7f11ffebf04312d77fd51590ad2e6c275dc6e
SHA512

26cf1345cf8da4b39245ab982fd0c513865ec2801fb35ef58e320a7fc05c38b59a0bfb1c63ee233ff174eff89f567459369e0ed744fea5f2609040c2e79ada20
SSDEEP

768:jSxam3Usjr3REXXr8yxFChMp7v9DLKrzCnbcuyD7UVeQI5no6cAvcV4RP0U+t6:jRsjdEIUFC2p79OCnouy8VDlAG4RsfU

Score

10^/10

evasion persistence upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

e3aaef1cf6d4ca0a0cfd557c0cf7f11ffebf04312d77fd51590ad2e6c275dc6e.exe

Resource

win7-20240215-en

evasion persistence upx

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

e3aaef1cf6d4ca0a0cfd557c0cf7f11ffebf04312d77fd51590ad2e6c275dc6e.exe

Resource

win10v2004-20240508-en

evasion persistence upx

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  e3aaef1cf6d4ca0a0cfd557c0cf7f11ffebf04312d77fd51590ad2e6c275dc6e
- Size
  
  63KB
- MD5
  
  371164f87275c60b2e1451c46588ffee
- SHA1
  
  59975974d2aa2bf1cd9a8e325a2647dca1e5d3db
- SHA256
  
  e3aaef1cf6d4ca0a0cfd557c0cf7f11ffebf04312d77fd51590ad2e6c275dc6e
- SHA512
  
  26cf1345cf8da4b39245ab982fd0c513865ec2801fb35ef58e320a7fc05c38b59a0bfb1c63ee233ff174eff89f567459369e0ed744fea5f2609040c2e79ada20
- SSDEEP
  
  768:jSxam3Usjr3REXXr8yxFChMp7v9DLKrzCnbcuyD7UVeQI5no6cAvcV4RP0U+t6:jRsjdEIUFC2p79OCnouy8VDlAG4RsfU
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UPX dump on OEP (original entry point)
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy