Overview

overview

8

Static

static

7

eaa48f7af6...0N.exe

windows7-x64

8

eaa48f7af6...0N.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    eaa48f7af637fe9970bd8792459fe770N.exe

  • Size

    256KB

  • Sample

    240817-j6favayfpj

  • MD5

    eaa48f7af637fe9970bd8792459fe770

  • SHA1

    b1febd14c90c7e851a3d54cab59e75e437e7e942

  • SHA256

    5c801317efad1e839e7c8fb2c5bb4895126bc16f5eccebec2fb9611d94d56816

  • SHA512

    26b78ccc687f876018c46eee56b45ede37669c517637e5a1200670c4c4d3a951c4218abb2f15e3204dfc08099ae9476e96585444f4309a92802f24d34933d16b

  • SSDEEP

    6144:ODLQxoyQ1LpnFyZ+dayL9rvolH8u3ZhGod:OQCyQ1LHk+zR7QHjGo

Score
8/10
discoverypersistencevmprotect

Malware Config

Targets

    • Target

      eaa48f7af637fe9970bd8792459fe770N.exe

    • Size

      256KB

    • MD5

      eaa48f7af637fe9970bd8792459fe770

    • SHA1

      b1febd14c90c7e851a3d54cab59e75e437e7e942

    • SHA256

      5c801317efad1e839e7c8fb2c5bb4895126bc16f5eccebec2fb9611d94d56816

    • SHA512

      26b78ccc687f876018c46eee56b45ede37669c517637e5a1200670c4c4d3a951c4218abb2f15e3204dfc08099ae9476e96585444f4309a92802f24d34933d16b

    • SSDEEP

      6144:ODLQxoyQ1LpnFyZ+dayL9rvolH8u3ZhGod:OQCyQ1LHk+zR7QHjGo

    Score
    8/10
    discoverypersistencevmprotect

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Drops file in Drivers directory

    • Deletes itself

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks