Overview

overview

10

Static

static

10

archiveNew.zip

windows10-2004-x64

8

archiveNew.zip

windows10-ltsc 2021-x64

10

archiveNew.zip

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    archiveNew.zip

  • Size

    143.6MB

  • Sample

    241026-w3vbtayapk

  • MD5

    a8fc24fe65d99f95eb044c2c233c6d2d

  • SHA1

    c19f64d122186fa8fcc7fb7d042f58ac419d1b2f

  • SHA256

    963c15274fc34edaf704feb2ad16ffa13e3d66a170728dad7831ba7b686424ed

  • SHA512

    163a4e16eb68ec3f018b5cceec350909940d8e982d1c07da6de427bd0e036ca3a3749d56b7aae43e72e433738ce6718cb5e2857f4c5aa158c962c05d9467691d

  • SSDEEP

    3145728:3deKZnQJwQvedhiSPSh9IcQyFkn1KaHdBbd6N2hH981Ao0yWLg6pmbOk:MKVQmaqhiSPFqkka9T6l2vyF6pmbOk

Score
10/10
blankgrabberdiscoveryevasionexecutionupx

Malware Config

Targets

    • Target

      archiveNew.zip

    • Size

      143.6MB

    • MD5

      a8fc24fe65d99f95eb044c2c233c6d2d

    • SHA1

      c19f64d122186fa8fcc7fb7d042f58ac419d1b2f

    • SHA256

      963c15274fc34edaf704feb2ad16ffa13e3d66a170728dad7831ba7b686424ed

    • SHA512

      163a4e16eb68ec3f018b5cceec350909940d8e982d1c07da6de427bd0e036ca3a3749d56b7aae43e72e433738ce6718cb5e2857f4c5aa158c962c05d9467691d

    • SSDEEP

      3145728:3deKZnQJwQvedhiSPSh9IcQyFkn1KaHdBbd6N2hH981Ao0yWLg6pmbOk:MKVQmaqhiSPFqkka9T6l2vyF6pmbOk

    Score
    10/10
    discoveryexecutionupxevasion

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks