Overview

overview

10

Static

static

1

dugga_848274.gz

windows10-2004-x64

8

dugga_848274.gz

windows11-21h2-x64

sample

windows10-2004-x64

1

sample

windows11-21h2-x64

1

Resubmissions

22-05-2024 09:47

240522-lses9sba38 4

22-05-2024 09:35

240522-lketasah4t 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dugga_848274.seb

  • Size

    5KB

  • Sample

    240522-lketasah4t

  • MD5

    7867d29c88ed216103feb5021f01ebf8

  • SHA1

    543af5ce7d60b6bf66d44d6bc42515d7fc97e796

  • SHA256

    43adf87d5486202112a4bdea368abc46b5fb6f2ae2a6083b8a87e18723b2feee

  • SHA512

    f0a22affd6b56154e0ad15a28fadedbc1977fc1fe72b6280d3d87c72ad8d7df1b3a465d9532869a30c09e88cd35ab0f0f6ed188513a38a5ae090d575797354a9

  • SSDEEP

    96:xUS0wqaXc0hWp9nVRcerCWZIIvj2y/dT2/7HpPotQWtfDmDa:xUncc79VierCW7vj9/Q/7pKQULf

Score
10/10
discoveryevasionexploittrojanupx

Malware Config

Targets

    • Target

      dugga_848274.seb

    • Size

      5KB

    • MD5

      7867d29c88ed216103feb5021f01ebf8

    • SHA1

      543af5ce7d60b6bf66d44d6bc42515d7fc97e796

    • SHA256

      43adf87d5486202112a4bdea368abc46b5fb6f2ae2a6083b8a87e18723b2feee

    • SHA512

      f0a22affd6b56154e0ad15a28fadedbc1977fc1fe72b6280d3d87c72ad8d7df1b3a465d9532869a30c09e88cd35ab0f0f6ed188513a38a5ae090d575797354a9

    • SSDEEP

      96:xUS0wqaXc0hWp9nVRcerCWZIIvj2y/dT2/7HpPotQWtfDmDa:xUncc79VierCW7vj9/Q/7pKQULf

    Score
    10/10
    discoveryevasionexploittrojanupx

    • UAC bypass

      evasiontrojan

    • Downloads MZ/PE file

    • Possible privilege escalation attempt

      exploit

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      sample

    • Size

      5KB

    • MD5

      c31020e4835be00569e290ee53515a93

    • SHA1

      9ff7b0031069f6371cf7ed8b53659873df3eee5a

    • SHA256

      629328afa29bb1b0abd0b3d5bc3fa71d232f8db3f639e4fbed78193306a1d665

    • SHA512

      d79054ad1d7b168ad594018cd4afbbb23191210c563556404d0769d05dc5d2d3c21edd271fd20d026fa2357e9770b2c52c53ae3d7b0aa753c3d95f295a55c7bd

    • SSDEEP

      96:TUS0wqaXc0hWp9nVRcerCWZIIvj2y/dT2/7HpPotQWtfDmDt:TUncc79VierCW7vj9/Q/7pKQULY

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks