35fa4d421411e037ef322f4db833dd2d877dbe66137d498156d6b379046a2fd6 | Triage

Submit
Reports

Overview

overview

Static

static

3

35fa4d4214...6N.exe

windows7-x64

35fa4d4214...6N.exe

windows10-2004-x64

Sharing

General

Target

35fa4d421411e037ef322f4db833dd2d877dbe66137d498156d6b379046a2fd6N
Size

328KB
Sample

240920-1qx96azdqc
MD5

eeb75c6ee0358e22180738dc900a0850
SHA1

f84c221c7bc554a80602051a914835aed6c3c44e
SHA256

35fa4d421411e037ef322f4db833dd2d877dbe66137d498156d6b379046a2fd6
SHA512

b28769d86a0da29ad7bbe139f46b6c306f07c3c8f266bc939eb60d4a218de492169259b24cbd0f35726cbbf7ea92fb276ca624d24da52c1a48d35cad90c8953a
SSDEEP

6144:J2XgY8FFX7Z6A/P352p4gFs/e8PeAZuon2T5T7UcIGMAQTeJ:J2X1cFx/PAp4ks/e6Fn2dEZGjQSJ

Score

10^/10

discovery evasion persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

35fa4d421411e037ef322f4db833dd2d877dbe66137d498156d6b379046a2fd6N.exe

Resource

win7-20240903-en

discovery evasion persistence upx

windows7-x64

12 signatures

120 seconds

Behavioral task

behavioral2

Sample

35fa4d421411e037ef322f4db833dd2d877dbe66137d498156d6b379046a2fd6N.exe

Resource

win10v2004-20240802-en

discovery evasion persistence upx

windows10-2004-x64

12 signatures

120 seconds

Malware Config

Targets

- Target
  
  35fa4d421411e037ef322f4db833dd2d877dbe66137d498156d6b379046a2fd6N
- Size
  
  328KB
- MD5
  
  eeb75c6ee0358e22180738dc900a0850
- SHA1
  
  f84c221c7bc554a80602051a914835aed6c3c44e
- SHA256
  
  35fa4d421411e037ef322f4db833dd2d877dbe66137d498156d6b379046a2fd6
- SHA512
  
  b28769d86a0da29ad7bbe139f46b6c306f07c3c8f266bc939eb60d4a218de492169259b24cbd0f35726cbbf7ea92fb276ca624d24da52c1a48d35cad90c8953a
- SSDEEP
  
  6144:J2XgY8FFX7Z6A/P352p4gFs/e8PeAZuon2T5T7UcIGMAQTeJ:J2X1cFx/PAp4ks/e6Fn2dEZGjQSJ
Score

10^/10

discovery evasion persistence upx
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceupx

behavioral2

discoveryevasionpersistenceupx

© 2018-2025

Terms | Privacy