0980cd1bf05cdbcf892a5e482b1cb2b767bc91331547c9f00c369e8cf7bcd37c | Triage

Submit
Reports

Overview

overview

Static

static

0980cd1bf0...7c.exe

windows7-x64

9

0980cd1bf0...7c.exe

windows10-2004-x64

9

Sharing

General

Target

0980cd1bf05cdbcf892a5e482b1cb2b767bc91331547c9f00c369e8cf7bcd37c
Size

232KB
Sample

240620-xahb8awcqk
MD5

9dd5defc0073a58af3e9f300c0f0e050
SHA1

4b880958676c854114a7a8408a1b69d53ddc9ece
SHA256

0980cd1bf05cdbcf892a5e482b1cb2b767bc91331547c9f00c369e8cf7bcd37c
SHA512

d07c9c1bf9832ee0761a1040d35e612ac92e83155ace309be3fe1e99fdc183c9f6b2055de4b2c745600ace8ebf27900ef46a467c1e00bb0adfe2c5ed0e366b81
SSDEEP

3072:y1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:si/NjO5xbg/CSUFLTwMjs6oi/N+O7

Score

10^/10

defense_evasion persistence upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

0980cd1bf05cdbcf892a5e482b1cb2b767bc91331547c9f00c369e8cf7bcd37c.exe

Resource

win7-20240220-en

defense_evasion persistence upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

0980cd1bf05cdbcf892a5e482b1cb2b767bc91331547c9f00c369e8cf7bcd37c.exe

Resource

win10v2004-20240508-en

defense_evasion persistence upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  0980cd1bf05cdbcf892a5e482b1cb2b767bc91331547c9f00c369e8cf7bcd37c
- Size
  
  232KB
- MD5
  
  9dd5defc0073a58af3e9f300c0f0e050
- SHA1
  
  4b880958676c854114a7a8408a1b69d53ddc9ece
- SHA256
  
  0980cd1bf05cdbcf892a5e482b1cb2b767bc91331547c9f00c369e8cf7bcd37c
- SHA512
  
  d07c9c1bf9832ee0761a1040d35e612ac92e83155ace309be3fe1e99fdc183c9f6b2055de4b2c745600ace8ebf27900ef46a467c1e00bb0adfe2c5ed0e366b81
- SSDEEP
  
  3072:y1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:si/NjO5xbg/CSUFLTwMjs6oi/N+O7
Score

9^/10

defense_evasion persistence upx
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasionpersistenceupx

behavioral2

defense_evasionpersistenceupx

© 2018-2024

Terms | Privacy