Overview

overview

7

Static

static

3

07374284c7...ba.exe

windows7-x64

7

07374284c7...ba.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07374284c7ce5a21453d3a8c513d5d817d748e1a2fc29981b1220aa8185a2bba.exe

  • Size

    128KB

  • Sample

    240521-x6mxksfh82

  • MD5

    29a091e765d47bfbaef72a032610bb00

  • SHA1

    a2617dce73d769f191781a9fbc4bd4e5afab1f46

  • SHA256

    07374284c7ce5a21453d3a8c513d5d817d748e1a2fc29981b1220aa8185a2bba

  • SHA512

    ddf73d7da051c29841fac251d9a9d41d4c0d389b69d6cd313352f92cf043d420614aa18041b65b859f3e7d00daabe02649ab3f0cee560c6d8bf761f16bda4f3d

  • SSDEEP

    3072:VvgwhTm5amkqIJS20hD7Me+QpWT21/Blx77x19:jmhUKWyJBlx77/9

Score
7/10
persistenceupx

Malware Config

Targets

    • Target

      07374284c7ce5a21453d3a8c513d5d817d748e1a2fc29981b1220aa8185a2bba.exe

    • Size

      128KB

    • MD5

      29a091e765d47bfbaef72a032610bb00

    • SHA1

      a2617dce73d769f191781a9fbc4bd4e5afab1f46

    • SHA256

      07374284c7ce5a21453d3a8c513d5d817d748e1a2fc29981b1220aa8185a2bba

    • SHA512

      ddf73d7da051c29841fac251d9a9d41d4c0d389b69d6cd313352f92cf043d420614aa18041b65b859f3e7d00daabe02649ab3f0cee560c6d8bf761f16bda4f3d

    • SSDEEP

      3072:VvgwhTm5amkqIJS20hD7Me+QpWT21/Blx77x19:jmhUKWyJBlx77/9

    Score
    7/10
    upxpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks