f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab | Triage

Sharing

General

Target

f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab
Size

36KB
Sample

241121-pxgp7s1hke
MD5

1e7e657e12560c3b7d950001a38cc8b1
SHA1

675d1cce2c0125f37871faa9dccc423f72a9a882
SHA256

f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab
SHA512

a41e1b7ec27b74fc5ae6a6057d1cf56ebf658bfccecc7e0cfd68b9aa1d36b9141f0765d612b7f367f5f5e74d4964c3323c7f3a05cd7eb728cadb9387cd836abb
SSDEEP

768:sIUmhCfRKfmrEhjR2cS5fzWbAGO8azppk9SNKGCc:sAhCZKfmrqjRu5fibAF8qYSNKhc

Score

10^/10

defense_evasion discovery evasion persistence trojan upx

Malware Config

Targets

- Target
  
  f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab
- Size
  
  36KB
- MD5
  
  1e7e657e12560c3b7d950001a38cc8b1
- SHA1
  
  675d1cce2c0125f37871faa9dccc423f72a9a882
- SHA256
  
  f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab
- SHA512
  
  a41e1b7ec27b74fc5ae6a6057d1cf56ebf658bfccecc7e0cfd68b9aa1d36b9141f0765d612b7f367f5f5e74d4964c3323c7f3a05cd7eb728cadb9387cd836abb
- SSDEEP
  
  768:sIUmhCfRKfmrEhjR2cS5fzWbAGO8azppk9SNKGCc:sAhCZKfmrqjRu5fibAF8qYSNKhc
Score

10^/10

defense_evasion discovery evasion persistence trojan upx
- Windows security bypass
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Impair Defenses

Disable or Modify Tools

Indicator Removal

Clear Persistence

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistencetrojanupx

behavioral2

defense_evasiondiscoveryevasionpersistencetrojanupx