Overview

overview

8

Static

static

7

9ff43958d0...ec.exe

windows7-x64

8

9ff43958d0...ec.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ff43958d0c9e1db3be8d08e3932e09bf528cc481fa9bdb5989d8d064a8ad9ec

  • Size

    38KB

  • Sample

    240727-bxy3laybkr

  • MD5

    b6d7801c402a0b30436c83d80e078950

  • SHA1

    f8fc2caf49fa0cda9c208d2998ab2bb929955600

  • SHA256

    9ff43958d0c9e1db3be8d08e3932e09bf528cc481fa9bdb5989d8d064a8ad9ec

  • SHA512

    2a9834245e79912ed886844f4422d90293b1b468e41c452f0303617a6dd16790389c4b8eb229d1ee22e0c2908ef08a9d5b35fd507882163d67d2d3066b89938a

  • SSDEEP

    768:Nzj1JegVa3Gry+uELEmITCs/NUZ6nZdYbCLECkrQoP9fmF2f1cOV:NWQa2TLEmITcoQxfllfmS1cOV

Score
8/10
discoveryevasionexecutionupx

Malware Config

Targets

    • Target

      9ff43958d0c9e1db3be8d08e3932e09bf528cc481fa9bdb5989d8d064a8ad9ec

    • Size

      38KB

    • MD5

      b6d7801c402a0b30436c83d80e078950

    • SHA1

      f8fc2caf49fa0cda9c208d2998ab2bb929955600

    • SHA256

      9ff43958d0c9e1db3be8d08e3932e09bf528cc481fa9bdb5989d8d064a8ad9ec

    • SHA512

      2a9834245e79912ed886844f4422d90293b1b468e41c452f0303617a6dd16790389c4b8eb229d1ee22e0c2908ef08a9d5b35fd507882163d67d2d3066b89938a

    • SSDEEP

      768:Nzj1JegVa3Gry+uELEmITCs/NUZ6nZdYbCLECkrQoP9fmF2f1cOV:NWQa2TLEmITcoQxfllfmS1cOV

    Score
    8/10
    discoveryevasionexecutionupx

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks