Overview

overview

10

Static

static

7

dc7b89f851...0N.exe

windows7-x64

10

dc7b89f851...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    dc7b89f8518997f86168ac780025cd60N.exe

  • Size

    87KB

  • Sample

    240814-qk5f6sthmd

  • MD5

    dc7b89f8518997f86168ac780025cd60

  • SHA1

    6dcab1569c1f9f641f64b66156f4ead1a037e133

  • SHA256

    04c4e69151db0575107e04cb911ae90b5a2ca1bad065b1d25e2cb1e5fb413685

  • SHA512

    949494b4693242d4c3a79b1441350dccdc3cb8403f2660e99427683428134aa426e29945fc3e58a371030c08e58b0fe70472161a1e0f89021048a88f657aa1f2

  • SSDEEP

    768:3Og167GTCGTL9tCqwhX52pwTu5gV62i9wb4CWYLyAKfPXvByNGOLDd5FBEewN4Wr:x0Y9WV32pau5gV62++Kf/vw/d5Uh4Ah

Score
10/10
defense_evasiondiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      dc7b89f8518997f86168ac780025cd60N.exe

    • Size

      87KB

    • MD5

      dc7b89f8518997f86168ac780025cd60

    • SHA1

      6dcab1569c1f9f641f64b66156f4ead1a037e133

    • SHA256

      04c4e69151db0575107e04cb911ae90b5a2ca1bad065b1d25e2cb1e5fb413685

    • SHA512

      949494b4693242d4c3a79b1441350dccdc3cb8403f2660e99427683428134aa426e29945fc3e58a371030c08e58b0fe70472161a1e0f89021048a88f657aa1f2

    • SSDEEP

      768:3Og167GTCGTL9tCqwhX52pwTu5gV62i9wb4CWYLyAKfPXvByNGOLDd5FBEewN4Wr:x0Y9WV32pau5gV62++Kf/vw/d5Uh4Ah

    Score
    10/10
    defense_evasiondiscoveryevasionpersistencetrojanupx

    • Windows security bypass

      evasiontrojan

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Indicator Removal: Clear Persistence

      remove IFEO.

      defense_evasion

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks