General

  • Target

    e941e12d40c517d3d0c54f63d63ea6cb8249d8f396ab7e8daf194c28217fdd96

  • Size

    229KB

  • Sample

    240601-favh4sah29

  • MD5

    687ff653341321e0aac3866259aa8c22

  • SHA1

    fbccf908227ba427ddf82653a49ed0cedafac4f1

  • SHA256

    e941e12d40c517d3d0c54f63d63ea6cb8249d8f396ab7e8daf194c28217fdd96

  • SHA512

    ac7dac6ea5ff8628c0769ef6711fe83c87f944f6a2a09dead094242f039bb389186eb78880f23ea01881c7b35f2e0f6e8be7508ac1a44c4e15625b5f94d892ed

  • SSDEEP

    6144:OhF4c/+wWJH7igNgjdFKsYYQKCxPYotvYQH:OMozXMYlCRYotvY+

Score
10/10

Malware Config

Targets

    • Target

      e941e12d40c517d3d0c54f63d63ea6cb8249d8f396ab7e8daf194c28217fdd96

    • Size

      229KB

    • MD5

      687ff653341321e0aac3866259aa8c22

    • SHA1

      fbccf908227ba427ddf82653a49ed0cedafac4f1

    • SHA256

      e941e12d40c517d3d0c54f63d63ea6cb8249d8f396ab7e8daf194c28217fdd96

    • SHA512

      ac7dac6ea5ff8628c0769ef6711fe83c87f944f6a2a09dead094242f039bb389186eb78880f23ea01881c7b35f2e0f6e8be7508ac1a44c4e15625b5f94d892ed

    • SSDEEP

      6144:OhF4c/+wWJH7igNgjdFKsYYQKCxPYotvYQH:OMozXMYlCRYotvY+

    Score
    10/10
    • Modifies WinLogon for persistence

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • UPX dump on OEP (original entry point)

    • Disables RegEdit via registry modification

    • Disables use of System Restore points

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks