9da30de1cac47cca4b0915edb3ac94bd28913e184921f4dd41d654dd61228268 | Triage

Submit
Reports

Overview

overview

Static

static

9da30de1ca...68.exe

windows7-x64

9da30de1ca...68.exe

windows10-2004-x64

Sharing

General

Target

9da30de1cac47cca4b0915edb3ac94bd28913e184921f4dd41d654dd61228268
Size

91KB
Sample

240605-beb54shd51
MD5

db07157b10583bcb7ed561eab4fd5364
SHA1

4651e0e6bdff7a075a79fda7983ce10f3f71a1df
SHA256

9da30de1cac47cca4b0915edb3ac94bd28913e184921f4dd41d654dd61228268
SHA512

1f1333457a911e242216c60f92f93f4669f653ef4e8df81d05aa2df297db2316cfb97d402b743dcb8086bf9b5e7741e62cc05e8c16c58e506a6159ad1016251b
SSDEEP

1536:zAwEmBZ04faWmtN4nic+6GeAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0eGms4Eton0f

Score

10^/10

evasion persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

9da30de1cac47cca4b0915edb3ac94bd28913e184921f4dd41d654dd61228268.exe

Resource

win7-20240221-en

evasion persistence

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

9da30de1cac47cca4b0915edb3ac94bd28913e184921f4dd41d654dd61228268.exe

Resource

win10v2004-20240508-en

evasion persistence

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  9da30de1cac47cca4b0915edb3ac94bd28913e184921f4dd41d654dd61228268
- Size
  
  91KB
- MD5
  
  db07157b10583bcb7ed561eab4fd5364
- SHA1
  
  4651e0e6bdff7a075a79fda7983ce10f3f71a1df
- SHA256
  
  9da30de1cac47cca4b0915edb3ac94bd28913e184921f4dd41d654dd61228268
- SHA512
  
  1f1333457a911e242216c60f92f93f4669f653ef4e8df81d05aa2df297db2316cfb97d402b743dcb8086bf9b5e7741e62cc05e8c16c58e506a6159ad1016251b
- SSDEEP
  
  1536:zAwEmBZ04faWmtN4nic+6GeAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0eGms4Eton0f
Score

10^/10

evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Detects executables built or packed with MPress PE compressor
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence

© 2018-2025

Terms | Privacy