ffdece8cf4dc25a2087b123c3d57744738a87c873ff38b7a5207029b2e76fcad | Triage

Submit
Reports

Overview

overview

Static

static

ffdece8cf4...ad.exe

windows7-x64

9

ffdece8cf4...ad.exe

windows10-2004-x64

9

Sharing

General

Target

ffdece8cf4dc25a2087b123c3d57744738a87c873ff38b7a5207029b2e76fcad
Size

143KB
Sample

240628-fqccgavfqr
MD5

44376c87b1baaa34bc75aac5c42a64ea
SHA1

0c4923dd36cbecbd1cf8e7fc0be3ab041e42934c
SHA256

ffdece8cf4dc25a2087b123c3d57744738a87c873ff38b7a5207029b2e76fcad
SHA512

4393404d8d8b6fedc1f73b57cce18407e07c75246334676e178ad9e693ee66631008cb491cadd8de8b9b9c5bfb743f7f6d7ecee55abe16d2a6057f0ae87a4161
SSDEEP

3072:+1i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgO5/1i/NU82OMYcYYamv5b:Ii/NjO5YBgegD0PHzSwi/N+O7

Score

10^/10

defense_evasion persistence upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

ffdece8cf4dc25a2087b123c3d57744738a87c873ff38b7a5207029b2e76fcad.exe

Resource

win7-20240221-en

defense_evasion persistence upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

ffdece8cf4dc25a2087b123c3d57744738a87c873ff38b7a5207029b2e76fcad.exe

Resource

win10v2004-20240611-en

defense_evasion persistence upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  ffdece8cf4dc25a2087b123c3d57744738a87c873ff38b7a5207029b2e76fcad
- Size
  
  143KB
- MD5
  
  44376c87b1baaa34bc75aac5c42a64ea
- SHA1
  
  0c4923dd36cbecbd1cf8e7fc0be3ab041e42934c
- SHA256
  
  ffdece8cf4dc25a2087b123c3d57744738a87c873ff38b7a5207029b2e76fcad
- SHA512
  
  4393404d8d8b6fedc1f73b57cce18407e07c75246334676e178ad9e693ee66631008cb491cadd8de8b9b9c5bfb743f7f6d7ecee55abe16d2a6057f0ae87a4161
- SSDEEP
  
  3072:+1i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgO5/1i/NU82OMYcYYamv5b:Ii/NjO5YBgegD0PHzSwi/N+O7
Score

9^/10

defense_evasion persistence upx
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasionpersistenceupx

behavioral2

defense_evasionpersistenceupx

© 2018-2025

Terms | Privacy