Overview

overview

10

Static

static

7

HELPME.zip

windows7-x64

10

Resubmissions

25/06/2024, 17:51

240625-wfdqjswhmq 10

25/06/2024, 17:49

240625-wedn6atfnf 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HELPME.zip

  • Size

    39.2MB

  • Sample

    240625-wfdqjswhmq

  • MD5

    54502fe7dadba03bc0eab2d6a060904e

  • SHA1

    fc4daf84748dc65a726cb95d232be77413ee6389

  • SHA256

    b8ad7e04f8bf344206a80de415f15d84782acc3934357d3fea3d09ea8e5ebc7f

  • SHA512

    1c3fb643294fd85d416dfee90165e0f63b74ebcfa60fadecc8f4f466908f097868342b86d28d6c66d7bb687bf294813ca74b3ee9abcf32c1848afebc9bd0ec7c

  • SSDEEP

    786432:moxSCOrQfO4ghIGSR7H9IJrs51uo8KaHPK9FoFT+HLs0o42o/J:P/HW4o0R7H9us51unHWFQT+vo45R

Score
10/10
bootkitevasionpersistenceupx

Malware Config

Targets

    • Target

      HELPME.zip

    • Size

      39.2MB

    • MD5

      54502fe7dadba03bc0eab2d6a060904e

    • SHA1

      fc4daf84748dc65a726cb95d232be77413ee6389

    • SHA256

      b8ad7e04f8bf344206a80de415f15d84782acc3934357d3fea3d09ea8e5ebc7f

    • SHA512

      1c3fb643294fd85d416dfee90165e0f63b74ebcfa60fadecc8f4f466908f097868342b86d28d6c66d7bb687bf294813ca74b3ee9abcf32c1848afebc9bd0ec7c

    • SSDEEP

      786432:moxSCOrQfO4ghIGSR7H9IJrs51uo8KaHPK9FoFT+HLs0o42o/J:P/HW4o0R7H9us51unHWFQT+vo45R

    Score
    10/10
    bootkitevasionpersistenceupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops desktop.ini file(s)

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks