03ea4351e966ad9c1245d8f92ad898a20cc5351719ac5028c4a1e6b9d9441316 | Triage

Submit
Reports

Overview

overview

Static

static

3

03ea4351e9...16.exe

windows7-x64

03ea4351e9...16.exe

windows10-2004-x64

Sharing

General

Target

03ea4351e966ad9c1245d8f92ad898a20cc5351719ac5028c4a1e6b9d9441316
Size

1.8MB
Sample

240818-wxswsszgmm
MD5

afe1ca04d34211c5b0b57fe6beda61e6
SHA1

0c1db640507b9624851d7d985a01223f21fc75ad
SHA256

03ea4351e966ad9c1245d8f92ad898a20cc5351719ac5028c4a1e6b9d9441316
SHA512

2b0e784ea490df9102c39dc1d52c780932b3c48284c547f1035fe304839ec21549df53e01ce684e505b8ce61b04348d78fbd119e70edb3e98cbd3558581d0b07
SSDEEP

49152:ALIUXQgBiI6i2KFU0yBfM7a9QDosGeo403e0CpcKYGIDlWIwRBOn5PvGYKMf/1Zy:cIUXQgBiI6i2KFU0yBfM7a9QDosGeo4B

Score

10^/10

discovery evasion persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

03ea4351e966ad9c1245d8f92ad898a20cc5351719ac5028c4a1e6b9d9441316.exe

Resource

win7-20240708-en

discovery evasion persistence upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

03ea4351e966ad9c1245d8f92ad898a20cc5351719ac5028c4a1e6b9d9441316.exe

Resource

win10v2004-20240802-en

discovery evasion persistence upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  03ea4351e966ad9c1245d8f92ad898a20cc5351719ac5028c4a1e6b9d9441316
- Size
  
  1.8MB
- MD5
  
  afe1ca04d34211c5b0b57fe6beda61e6
- SHA1
  
  0c1db640507b9624851d7d985a01223f21fc75ad
- SHA256
  
  03ea4351e966ad9c1245d8f92ad898a20cc5351719ac5028c4a1e6b9d9441316
- SHA512
  
  2b0e784ea490df9102c39dc1d52c780932b3c48284c547f1035fe304839ec21549df53e01ce684e505b8ce61b04348d78fbd119e70edb3e98cbd3558581d0b07
- SSDEEP
  
  49152:ALIUXQgBiI6i2KFU0yBfM7a9QDosGeo403e0CpcKYGIDlWIwRBOn5PvGYKMf/1Zy:cIUXQgBiI6i2KFU0yBfM7a9QDosGeo4B
Score

10^/10

discovery evasion persistence upx
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceupx

behavioral2

discoveryevasionpersistenceupx

© 2018-2025

Terms | Privacy