Overview

overview

9

Static

static

3

mods‮piz.exe

windows7-x64

7

mods‮piz.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mods‮piz.rar

  • Size

    72.9MB

  • Sample

    240721-txq14axdmm

  • MD5

    7573fde62a2ae0b214c72014d26278fb

  • SHA1

    650e2d751f9bcc4a3dcc08d4174abc3415460d13

  • SHA256

    8ebfd7624a00302557410c85bd867812583d34b18e062628de0b9ae5bca787e5

  • SHA512

    952939f9de79790ddb098d11313cc4dabc49ea01a30166972b1566cc62cc5425f95aef8a501996bc720d751b703d1aab2bf8b0239b04977c4cfaf59daae7de3c

  • SSDEEP

    1572864:paCDFcrqb/OVjDkfgr7oNrLzGkz5KeQG7M7mkPLqp3i:paChr/OVpreLpzEeA7mkeVi

Score
9/10
evasionexecutionpersistenceupx

Malware Config

Targets

    • Target

      mods‮piz.exe

    • Size

      73.0MB

    • MD5

      ae7d85cf0430d043044a1ca6245b56ac

    • SHA1

      6978bbd6092b7e73e319b2273292ad6057657f0f

    • SHA256

      ba43492356bfced1b66531776d1c1e875739779ba3110cb94320ea4f77c2bfb4

    • SHA512

      c43686fb796d82b9b13a3fe527a4f4f9f5e0845a643fbc5ff7f738d368107cddc13b48646397f07ff5f1ad751b50cf0f26621bfaedef50511f4e5f99f01cb0fb

    • SSDEEP

      1572864:rI2x6vSwY76NapdidyEmwSDzBzSOiBIn/rCnuR6ZT1vGil5VSy:rI2xgSv7sKimRzVj1/rCLjl5x

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks