8d7bc3d7175f3d25eb9897a0c2677f3a27c974f75ead7fbe992a087876579eb0 | Triage

Sharing

General

Target

8d7bc3d7175f3d25eb9897a0c2677f3a27c974f75ead7fbe992a087876579eb0N
Size

78KB
Sample

241109-neqdystclk
MD5

29224d003ac3618539644371a3f401c0
SHA1

d56ba65ae08aaabee6f1cec018d26eba105295a4
SHA256

8d7bc3d7175f3d25eb9897a0c2677f3a27c974f75ead7fbe992a087876579eb0
SHA512

9ed900748293739a914107e20926be153972164fdb72f6acecb98cd7a72e4d31e02aa977dd8c22d5a1e54245678a8f5eeb5c46b635bdfeac6b1c192290b493c9
SSDEEP

1536:EupTX/isjATD5vo8fTmQ0+s932FgDcKnvtqMjL7jGQi46aFJ:fTXqM8Ddo8fsvGFgIKn1qw/GQi46w

Score

10^/10

adware discovery persistence stealer upx

Malware Config

Targets

- Target
  
  8d7bc3d7175f3d25eb9897a0c2677f3a27c974f75ead7fbe992a087876579eb0N
- Size
  
  78KB
- MD5
  
  29224d003ac3618539644371a3f401c0
- SHA1
  
  d56ba65ae08aaabee6f1cec018d26eba105295a4
- SHA256
  
  8d7bc3d7175f3d25eb9897a0c2677f3a27c974f75ead7fbe992a087876579eb0
- SHA512
  
  9ed900748293739a914107e20926be153972164fdb72f6acecb98cd7a72e4d31e02aa977dd8c22d5a1e54245678a8f5eeb5c46b635bdfeac6b1c192290b493c9
- SSDEEP
  
  1536:EupTX/isjATD5vo8fTmQ0+s932FgDcKnvtqMjL7jGQi46aFJ:fTXqM8Ddo8fsvGFgIKn1qw/GQi46w
Score

10^/10

adware discovery persistence stealer upx
- Modifies WinLogon for persistence
  persistence
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Modifies WinLogon
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Browser Extensions

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencestealerupx

behavioral2

adwarediscoverypersistencestealerupx