Overview

overview

10

Static

static

7

e49ac7a179...0N.exe

windows7-x64

10

e49ac7a179...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e49ac7a179d7d2edb448913c2af1cbe0N.exe

  • Size

    63KB

  • Sample

    240819-nmay8svejp

  • MD5

    e49ac7a179d7d2edb448913c2af1cbe0

  • SHA1

    dd4677837ecd428eba242a7f21b1e035a8a09053

  • SHA256

    40a005943e26eb0e4dca65058f61a01018ed44ecf382e32b6103ee038f527651

  • SHA512

    ecb6755ed404f17e18006d95bc4e76c1f61e6cd5e914000cf3825f103b3b8b48478a38d0be461be67ea611ba405ee1fd270920c82eb5b09ef6138b73a155e397

  • SSDEEP

    768:jSxam3Usjr3REXXr8yxFChMp7v9DLKrzCnbcuyD7UVeQI5noc2cAvcV4RP0U+t6:jRsjdEIUFC2p79OCnouy8VDUAG4RsfU

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      e49ac7a179d7d2edb448913c2af1cbe0N.exe

    • Size

      63KB

    • MD5

      e49ac7a179d7d2edb448913c2af1cbe0

    • SHA1

      dd4677837ecd428eba242a7f21b1e035a8a09053

    • SHA256

      40a005943e26eb0e4dca65058f61a01018ed44ecf382e32b6103ee038f527651

    • SHA512

      ecb6755ed404f17e18006d95bc4e76c1f61e6cd5e914000cf3825f103b3b8b48478a38d0be461be67ea611ba405ee1fd270920c82eb5b09ef6138b73a155e397

    • SSDEEP

      768:jSxam3Usjr3REXXr8yxFChMp7v9DLKrzCnbcuyD7UVeQI5noc2cAvcV4RP0U+t6:jRsjdEIUFC2p79OCnouy8VDUAG4RsfU

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks