3aa51a1301c959c76d2d0502b1c82f274365ba8044891e879cb04f9db76839e2 | Triage

Submit
Reports

Overview

overview

Static

static

5

3aa51a1301...e2.exe

windows7-x64

3aa51a1301...e2.exe

windows10-2004-x64

Sharing

General

Target

3aa51a1301c959c76d2d0502b1c82f274365ba8044891e879cb04f9db76839e2.exe
Size

93KB
Sample

241119-xtr1rs1ejm
MD5

a35fb3db2a4c592b19db3f8ac2f64bbc
SHA1

c3941549e5bc214fe8014b0b1ba4d25158a2530e
SHA256

3aa51a1301c959c76d2d0502b1c82f274365ba8044891e879cb04f9db76839e2
SHA512

09513f52a128783e72f03819f50145ddc929254021737612922b1859de943a99ccaab2097f2382043c09b19eca99d8725a2143e1cc4ca80e7adaf6be388092f7
SSDEEP

1536:XEZFdJ1sQMwurs+p59VK1DAcwBGTHQk/TYNyZO6ZK+/e2roQLKtUNj81h9:srTMw2npL0VpxZDm2rZG4yh9

Score

10^/10

discovery evasion persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

3aa51a1301c959c76d2d0502b1c82f274365ba8044891e879cb04f9db76839e2.exe

Resource

win7-20240903-en

discovery evasion persistence upx

windows7-x64

12 signatures

120 seconds

Behavioral task

behavioral2

Sample

3aa51a1301c959c76d2d0502b1c82f274365ba8044891e879cb04f9db76839e2.exe

Resource

win10v2004-20241007-en

discovery evasion persistence upx

windows10-2004-x64

11 signatures

120 seconds

Malware Config

Targets

- Target
  
  3aa51a1301c959c76d2d0502b1c82f274365ba8044891e879cb04f9db76839e2.exe
- Size
  
  93KB
- MD5
  
  a35fb3db2a4c592b19db3f8ac2f64bbc
- SHA1
  
  c3941549e5bc214fe8014b0b1ba4d25158a2530e
- SHA256
  
  3aa51a1301c959c76d2d0502b1c82f274365ba8044891e879cb04f9db76839e2
- SHA512
  
  09513f52a128783e72f03819f50145ddc929254021737612922b1859de943a99ccaab2097f2382043c09b19eca99d8725a2143e1cc4ca80e7adaf6be388092f7
- SSDEEP
  
  1536:XEZFdJ1sQMwurs+p59VK1DAcwBGTHQk/TYNyZO6ZK+/e2roQLKtUNj81h9:srTMw2npL0VpxZDm2rZG4yh9
Score

10^/10

discovery evasion persistence upx
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceupx

behavioral2

discoveryevasionpersistenceupx

© 2018-2025

Terms | Privacy