Extracted

Extracted

• • Target

    test/91B5DB3C0CCBD68BD04C24571E27F99D.msi

  • Size

    277KB

  • MD5

    91b5db3c0ccbd68bd04c24571e27f99d

  • SHA1

    b01cb4fe38315d41fcbe9c6278ebe4574496ab0d

  • SHA256

    ec85138598c57c6a6bdb5ed470614f582d3b5a8c6b243eb2f41b9970ea13d130

  • SHA512

    9f0b07f961625fcc06ee64fcfe5e35e0d40db81f75c3cbc584434c1925fac241db69cac3c1a1bf329d965a4df9bdaa53c13bb8ea3206e2c9d4facf7f74ba21b7

  Score

  8^/10

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2

• • Target

    test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

  • Size

    3.4MB

  • MD5

    84c82835a5d21bbcf75a61706d8ab549

  • SHA1

    5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

  • SHA256

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

  • SHA512

    90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

  Score

  10^/10

  wannacrydiscoveryransomwarewormspywarestealer

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral3behavioral4

• • Target

    test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe

  • Size

    3.6MB

  • MD5

    743a6891999db5d7179091aba5f98fdb

  • SHA1

    eeca4b8f88fcae9db6f54304270699d459fb5722

  • SHA256

    fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f

  • SHA512

    9edef033663c828536190332ec87ac0096ffddae934d17c51b255a55ecb05774211a0edb1915c19384641befa291cfdfd2e3f878bf3b827f8b203ec1bee9dd96

  Score

  10^/10

  flawedammyyevasionpersistencetrojan

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

    trojanflawedammyy

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral5behavioral6

• • Target

    test/main.exe

  • Size

    2.2MB

  • MD5

    5ffb3bfb8e0b0002d940ad4707d1c504

  • SHA1

    ed6402ebc9050fd7c85384ec88343c556df3a71e

  • SHA256

    aa80d3eaee384c8a0ba25b3d501dc0c83f7405190ae47877595fc63cf3161dcf

  • SHA512

    3f05b5c0c80223ecff25f7c8c6a1d6b6462e80ca918f526b6fe0e229f0c1631ea25bf0f856338551e32f8cf9a2a0c838941136cd788ae89b1826aaeeb2a2ccf0

  Score

  10^/10

  persistence

  • Registers COM server for autorun

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral7behavioral8

• • Target

    test/main_temp.exe

  • Size

    2.6MB

  • MD5

    52bbc76cac35134534361c33a583b87a

  • SHA1

    45db17d6796da108f3f6bdb89f04365ae7d488ee

  • SHA256

    d26349b86c9428c0c18df9403b85d2443b866b0e7b99a4a1c8254bd0155326fd

  • SHA512

    9cb6821313018064887a635f74512d947a8425f7093f6284aab776d87eb3914b012156e51fce7f8911daf8d66fdeaa4e6206b3d621ed380c547a1c3c2d0bcbc1

  Score

  1^/10
  behavioral9behavioral10