Overview

overview

10

Static

static

7

e294a63709...2N.exe

windows7-x64

10

e294a63709...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N

  • Size

    45KB

  • Sample

    240921-ampwhawerk

  • MD5

    d1ab10ce6846f8d4ad0596d76f690070

  • SHA1

    61d21a46bdab224edadc00d51dad6300f5a069fa

  • SHA256

    e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452

  • SHA512

    d6b0a07f6c06edca52e6e61644fbbb17ecb138a265cbf831e1b0c5ffadc15782057b31f768799537d9afec0e365bc8dfca771d97dc91b8400615e0b13d6828e3

  • SSDEEP

    768:kSxam3Usjr3RT594UPS8GGCMDDxW738HbFtnbcuyD7UVOQI5nof:kRsjd3GR2Dxy387Lnouy8VTf

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452N

    • Size

      45KB

    • MD5

      d1ab10ce6846f8d4ad0596d76f690070

    • SHA1

      61d21a46bdab224edadc00d51dad6300f5a069fa

    • SHA256

      e294a63709334b5abd9c8c07b10b5a2a2a389be6dfa531e5f61a7a4b7d52c452

    • SHA512

      d6b0a07f6c06edca52e6e61644fbbb17ecb138a265cbf831e1b0c5ffadc15782057b31f768799537d9afec0e365bc8dfca771d97dc91b8400615e0b13d6828e3

    • SSDEEP

      768:kSxam3Usjr3RT594UPS8GGCMDDxW738HbFtnbcuyD7UVOQI5nof:kRsjd3GR2Dxy387Lnouy8VTf

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.