General

  • Target

    da285a3fd1f4bcb67362a2b7c033aee2e83214073d33f3c607966f6f031941e1

  • Size

    90KB

  • Sample

    240603-e3g8tabc7z

  • MD5

    056c0582c80df41cc6bdc31e2002a589

  • SHA1

    d53ea58f1efb0c2086585e8b2067ca8ae5a6be49

  • SHA256

    da285a3fd1f4bcb67362a2b7c033aee2e83214073d33f3c607966f6f031941e1

  • SHA512

    0e82b0cb66a52796be67034e0de73c5e735045811315c51f846a5fd5319fb801d855423644c7f2d71fa7478ba0b23fee62f098e1ad25ff0d1ba869f8c540b515

  • SSDEEP

    1536:ERsjdf1aM67v32Z9x5nouy8VTIRsjdf1aM67v32Z9x5nouy8VT:EOaHv3YpoutNIOaHv3YpoutN

Score
10/10

Malware Config

Targets

    • Target

      da285a3fd1f4bcb67362a2b7c033aee2e83214073d33f3c607966f6f031941e1

    • Size

      90KB

    • MD5

      056c0582c80df41cc6bdc31e2002a589

    • SHA1

      d53ea58f1efb0c2086585e8b2067ca8ae5a6be49

    • SHA256

      da285a3fd1f4bcb67362a2b7c033aee2e83214073d33f3c607966f6f031941e1

    • SHA512

      0e82b0cb66a52796be67034e0de73c5e735045811315c51f846a5fd5319fb801d855423644c7f2d71fa7478ba0b23fee62f098e1ad25ff0d1ba869f8c540b515

    • SSDEEP

      1536:ERsjdf1aM67v32Z9x5nouy8VTIRsjdf1aM67v32Z9x5nouy8VT:EOaHv3YpoutNIOaHv3YpoutN

    Score
    10/10
    • Modifies WinLogon for persistence

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • UPX dump on OEP (original entry point)

    • Disables RegEdit via registry modification

    • Disables use of System Restore points

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks