General

  • Target

    9dc78a7c0120787631185f55bbed144e82c19e8eb0c2a66e445ed40db2ee4d99

  • Size

    292KB

  • Sample

    240611-bjszesyemj

  • MD5

    a273044943723ee8f98fc5212a5176b2

  • SHA1

    83840f7c21ba99a59cbad0c3a80cdf4fb2d5460b

  • SHA256

    9dc78a7c0120787631185f55bbed144e82c19e8eb0c2a66e445ed40db2ee4d99

  • SHA512

    e3b7f6fd0a1bd922d091dafce5fa73b55a85917aa18a0067b7dc4e89501de916029c35ed46677e4bf24012c97f5347e32c119721bf866ba947bdf4a95660112e

  • SSDEEP

    3072:2r+Fu6eC0VjywzvcXcSqviamCIngQMTqGMWH2EZjg1wmxNAntKHzvtCQj:E5vcXgvibeqGNWE9+7AnAHzvtB

Score
10/10
upx

Malware Config

Targets

    • Target

      9dc78a7c0120787631185f55bbed144e82c19e8eb0c2a66e445ed40db2ee4d99

    • Size

      292KB

    • MD5

      a273044943723ee8f98fc5212a5176b2

    • SHA1

      83840f7c21ba99a59cbad0c3a80cdf4fb2d5460b

    • SHA256

      9dc78a7c0120787631185f55bbed144e82c19e8eb0c2a66e445ed40db2ee4d99

    • SHA512

      e3b7f6fd0a1bd922d091dafce5fa73b55a85917aa18a0067b7dc4e89501de916029c35ed46677e4bf24012c97f5347e32c119721bf866ba947bdf4a95660112e

    • SSDEEP

      3072:2r+Fu6eC0VjywzvcXcSqviamCIngQMTqGMWH2EZjg1wmxNAntKHzvtCQj:E5vcXgvibeqGNWE9+7AnAHzvtB

    Score
    9/10
    • UPX dump on OEP (original entry point)

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Blocklisted process makes network request

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks