Overview

overview

10

Static

static

7

6690204ed0...47.exe

windows7-x64

10

6690204ed0...47.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f8c828f938d4ed21c3c0d69a1c9211e4.zip

  • Size

    28KB

  • Sample

    240903-agyapa1emp

  • MD5

    592cf5826f5146d55c28c324263b5985

  • SHA1

    b0a6f825b4967ad8ab2128c663e121b834f8e041

  • SHA256

    5b570a3df3a2f0a54427482b5280b343d74d9ab555e17ee4017ae065997929c8

  • SHA512

    c1192c6003aa1f65c174f37e494a6fbb67c822d50026da4feff80b03ee61b29f6e84f78e99e5be4882248790eeb4184b4b7bce8ac8bc608922f22f9ca62b4b91

  • SSDEEP

    768:7P1AmO47ZnuqJY/wYsLwahYAGkG7KQcmny:7NFOuewYOYl+rmy

Score
10/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      6690204ed0041210274e149fd7aa719b242cbc25a046bf5274c26bfb0c7feb47

    • Size

      33KB

    • MD5

      f8c828f938d4ed21c3c0d69a1c9211e4

    • SHA1

      198636a32191acc85071a8ef4ad77dbd2f08c3da

    • SHA256

      6690204ed0041210274e149fd7aa719b242cbc25a046bf5274c26bfb0c7feb47

    • SHA512

      82f546ad372f6c093bd4881435f79a368320a2e6952fbbad83f69c0d193df79418a2464198db2aaebd036c681944ea01139aa27e9698ee61dee337039c09c5f4

    • SSDEEP

      768:UEzNbLcQ9qQuVriDMuyuruTD0qB77777J77c77c77c7nOT1g:l3h9qQA6hZunrB77777J77c77c77c7O+

    Score
    10/10
    discoverypersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks