69e06fc6c68a774fcdb6f058e76486712f29e8ea5636f5da58142b4124203ffd | Triage

Submit
Reports

Overview

overview

Static

static

69e06fc6c6...fd.exe

windows7-x64

69e06fc6c6...fd.exe

windows10-2004-x64

Sharing

General

Target

69e06fc6c68a774fcdb6f058e76486712f29e8ea5636f5da58142b4124203ffd
Size

63KB
Sample

240530-2xb6yach9w
MD5

cf09b93381cb9f47f7e7591818cccb12
SHA1

dfae8cda8dd925c3ef07a8c10e68ec700d55ddde
SHA256

69e06fc6c68a774fcdb6f058e76486712f29e8ea5636f5da58142b4124203ffd
SHA512

18657439715fd161183e41f701dc52ca223dee25b807fd14dfddb5f489e80db39d7d59a98417aee5b8b59bcd42b42d6050392cb212e2e48a4f3bc224f7540f51
SSDEEP

768:jSxam3Usjr3REXXr8yxFChMp7v9DLKrzCnbcuyD7UVeQI5noScAvcV4RP0U+t6:jRsjdEIUFC2p79OCnouy8VDNAG4RsfU

Score

10^/10

evasion persistence upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

69e06fc6c68a774fcdb6f058e76486712f29e8ea5636f5da58142b4124203ffd.exe

Resource

win7-20240419-en

evasion persistence upx

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

69e06fc6c68a774fcdb6f058e76486712f29e8ea5636f5da58142b4124203ffd.exe

Resource

win10v2004-20240426-en

evasion persistence upx

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  69e06fc6c68a774fcdb6f058e76486712f29e8ea5636f5da58142b4124203ffd
- Size
  
  63KB
- MD5
  
  cf09b93381cb9f47f7e7591818cccb12
- SHA1
  
  dfae8cda8dd925c3ef07a8c10e68ec700d55ddde
- SHA256
  
  69e06fc6c68a774fcdb6f058e76486712f29e8ea5636f5da58142b4124203ffd
- SHA512
  
  18657439715fd161183e41f701dc52ca223dee25b807fd14dfddb5f489e80db39d7d59a98417aee5b8b59bcd42b42d6050392cb212e2e48a4f3bc224f7540f51
- SSDEEP
  
  768:jSxam3Usjr3REXXr8yxFChMp7v9DLKrzCnbcuyD7UVeQI5noScAvcV4RP0U+t6:jRsjdEIUFC2p79OCnouy8VDNAG4RsfU
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UPX dump on OEP (original entry point)
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy