Overview

overview

10

Static

static

5

4c4b5c0168...dN.exe

windows7-x64

10

4c4b5c0168...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c4b5c0168820b83df1bf14fb385fc0e48bf896c9868b8d8357dbac613b4b46dN.exe

  • Size

    20KB

  • Sample

    250120-k6vwzaslen

  • MD5

    753d99248cd46572938a6700ba2d6550

  • SHA1

    453edba4c9d47ddeb28b83f05231fa9554e61c60

  • SHA256

    4c4b5c0168820b83df1bf14fb385fc0e48bf896c9868b8d8357dbac613b4b46d

  • SHA512

    9cc5419ded48d41812b044aa6b2afc215b5eb4d42f2372fc06f671c183a04399e137bfae924fb3b0c01f10205b593ecfe26b34063581fb1b52268682d32083c3

  • SSDEEP

    384:xScEHK2HaSvfKzxWQ7U+UqzykEX/RAjnP/nvdOsy1kwOw:Qc4PH3yzJ7U+UqS+DVOIwO

Score
10/10
discoveryevasionexecutionpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      4c4b5c0168820b83df1bf14fb385fc0e48bf896c9868b8d8357dbac613b4b46dN.exe

    • Size

      20KB

    • MD5

      753d99248cd46572938a6700ba2d6550

    • SHA1

      453edba4c9d47ddeb28b83f05231fa9554e61c60

    • SHA256

      4c4b5c0168820b83df1bf14fb385fc0e48bf896c9868b8d8357dbac613b4b46d

    • SHA512

      9cc5419ded48d41812b044aa6b2afc215b5eb4d42f2372fc06f671c183a04399e137bfae924fb3b0c01f10205b593ecfe26b34063581fb1b52268682d32083c3

    • SSDEEP

      384:xScEHK2HaSvfKzxWQ7U+UqzykEX/RAjnP/nvdOsy1kwOw:Qc4PH3yzJ7U+UqS+DVOIwO

    Score
    10/10
    discoveryevasionexecutionpersistenceprivilege_escalationupx

    • Disables service(s)

      evasionexecution

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Account Manipulation

1
T1098

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Account Manipulation

1
T1098

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2
T1489

Tasks