Overview

overview

10

Static

static

5

9cf08152f1...02.exe

windows7-x64

10

9cf08152f1...02.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cf08152f1c39c41797195feaaec1e5d8276a4f78bd5636607146bec3abb8a02

  • Size

    63KB

  • Sample

    241101-vtaqdavkfq

  • MD5

    d727c986e95a42f9719a160971c827ed

  • SHA1

    305e3050196c50ff0f17609182d6292e89fd676b

  • SHA256

    9cf08152f1c39c41797195feaaec1e5d8276a4f78bd5636607146bec3abb8a02

  • SHA512

    0c8d62389816c63723d7abafcccf0ee2556a3922c8b4790f670210f3f18a74368d94826f2ce733dcf3f6c45e9838a2387809d700215ac8f3efcda7d8d65d1cda

  • SSDEEP

    768:ZSxam3Usjr3RT594UPS8GGCMDDxW738HbFtnbcuyD7UVOQI5noRcAvcV4RP0U+t6:ZRsjd3GR2Dxy387Lnouy8VTGAG4RsfU

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      9cf08152f1c39c41797195feaaec1e5d8276a4f78bd5636607146bec3abb8a02

    • Size

      63KB

    • MD5

      d727c986e95a42f9719a160971c827ed

    • SHA1

      305e3050196c50ff0f17609182d6292e89fd676b

    • SHA256

      9cf08152f1c39c41797195feaaec1e5d8276a4f78bd5636607146bec3abb8a02

    • SHA512

      0c8d62389816c63723d7abafcccf0ee2556a3922c8b4790f670210f3f18a74368d94826f2ce733dcf3f6c45e9838a2387809d700215ac8f3efcda7d8d65d1cda

    • SSDEEP

      768:ZSxam3Usjr3RT594UPS8GGCMDDxW738HbFtnbcuyD7UVOQI5noRcAvcV4RP0U+t6:ZRsjd3GR2Dxy387Lnouy8VTGAG4RsfU

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks