Overview
overview
10Static
static
87z2201-x64.exe
windows10-2004-x64
10Firefox_Se....4.exe
windows10-2004-x64
8SumatraPDF...ll.exe
windows10-2004-x64
8TB_Free_In...63.exe
windows10-2004-x64
8XnView-511...ll.exe
windows10-2004-x64
9avast_free...ne.exe
windows10-2004-x64
10torbrowser...de.exe
windows10-2004-x64
8vlc-3.0.17...64.exe
windows10-2004-x64
8General
-
Target
c.zip
-
Size
224.8MB
-
Sample
221103-t5mcwaceb5
-
MD5
b95158bb93475622af1d1aef93d2ebf2
-
SHA1
b80287917411d1aedf4fe4d7ca5d70dcb969881f
-
SHA256
11e329f394675a2cf12b6c20ccd696ba555838872e4ec93797186683fe68588e
-
SHA512
d6b68ab66e90e7c1c9a40687890365de43dc775e842240fc5c6cfa6530355ebc450c3a8379807efd7340e57f7acb5483ba164d7716b3f878da5d8bc1c1e2d911
-
SSDEEP
6291456:LLUWPhJ5xdQCMVPVuQLyOWN8YIJ0snmbXFBvrRlw2On:EqvZQTVcQL4NpFXFBvrRlqn
Behavioral task
behavioral1
Sample
7z2201-x64.exe
Resource
win10v2004-20220812-de
Behavioral task
behavioral2
Sample
Firefox_Setup_106.0.4.exe
Resource
win10v2004-20220812-de
Behavioral task
behavioral3
Sample
SumatraPDF-3.4-64-install.exe
Resource
win10v2004-20220812-de
Behavioral task
behavioral4
Sample
TB_Free_Installer_20220922.5363.exe
Resource
win10v2004-20220812-de
Behavioral task
behavioral5
Sample
XnView-511win-full.exe
Resource
win10v2004-20220812-de
Behavioral task
behavioral6
Sample
avast_free_antivirus_setup_online.exe
Resource
win10v2004-20220812-de
Behavioral task
behavioral7
Sample
torbrowser-install-win64-11.5.6_de.exe
Resource
win10v2004-20220812-de
Behavioral task
behavioral8
Sample
vlc-3.0.17.4-win64.exe
Resource
win10v2004-20220812-de
Malware Config
Extracted
C:\Program Files\7-Zip\History.txt
Targets
-
-
Target
7z2201-x64.exe
-
Size
1.5MB
-
MD5
a6a0f7c173094f8dafef996157751ecf
-
SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580
-
SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
-
SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94
-
SSDEEP
24576:mGIyixBMj+/A2d+UKnvT+LwZWj7iDDVVYrz0rbzGTw3DoA/sk6smE:mGbj+/BpKnvyIxVV/XDoAfmE
Score10/10-
Registers COM server for autorun
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
Firefox_Setup_106.0.4.exe
-
Size
54.7MB
-
MD5
ab2e6fcc50ec1d0f150bda409b38fcc4
-
SHA1
1cad0f34fd41396b189f270a3c904dc59d1291c2
-
SHA256
62e587d3263950d2f34098d883fae4acc7e684fd83b545adf0c41f9b1ffe53a1
-
SHA512
da80f2111a1e6366239f57abe98623542df846835cb0f9ac0df985564898e2b7fa53ec2c1a6cc87460442652c11fccddcbcd6c24d9f9d5712cb2d1b3d44a061e
-
SSDEEP
1572864:0zKE4v0e7KYKpzUl1Razelodor4nC9JRix+WmzQ:KmJ7BOYaz+odRnCfRiQWmk
-
Executes dropped EXE
-
Registers COM server for autorun
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
SumatraPDF-3.4-64-install.exe
-
Size
7.1MB
-
MD5
92cd610bc19dc7a462aa8ca52a8cf0cf
-
SHA1
6f2c728a604efa75302097e66aebb91bbd828f82
-
SHA256
1d24e11ea522c4bdbdb20b0f112fba5ceaa0e4eddf2227cf7310c8da4b123bbd
-
SHA512
54afab5f75fbbd3289f5ea106dff53df3e0547e05b0c31474165b18433c268ff6ee8f111ea0baffdc85c4a63b27df0102db884a48c3af1d53c7ec87e90770417
-
SSDEEP
196608:LTxCcXis/+6yoGetiKQPKV6I6YZvbr8AKXI:h7+6Bt+ParZvb/SI
Score8/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
TB_Free_Installer_20220922.5363.exe
-
Size
1.3MB
-
MD5
d76c47211551f7c1f1427b4bad8e6aa9
-
SHA1
507c01d8cb2a3f71079b4b5110b533f9f6285ac7
-
SHA256
e680301ef8cbba2694f9826dd6cb4b7363e41040f2bd0af6014369f76751b32b
-
SHA512
04505ce953e9403a7c79699d3427e57d6237e2875920eb325cfa6bdf6264a095fc3ae7c38aed85bae803b19582e1ed43c0c8425055d543c81c077b5e5ae399b3
-
SSDEEP
24576:ZOr6qSJAHsD7KkT4kAC1PhCa9KRMdJYIHnsCmgFhKuYdKU6M6+q:m/u1A2ZCLMdJYnCTn8dYME
Score8/10-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Registers COM server for autorun
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
-
-
Target
XnView-511win-full.exe
-
Size
20.5MB
-
MD5
292a7bc525061db0b95abac0823d5e5e
-
SHA1
abde8c6b1149350f1f1cc380bfd4d01155e00481
-
SHA256
71bfc3d88fac614a40428c69e9113b1d4f6f6cb593762d59596b69ff5bcfd43f
-
SHA512
69f6b59339fa8c31fcb54eebedd243953e0ec57e0d5ee5a9aa3b73067c2f76bc38076543f2a621cdd304b42ce11a87b0a73ff8ba77a6faf54342e00047c06471
-
SSDEEP
393216:tcHoeONtWYeODNdXPybg9rdhjaC+WeeesjmVKUZwcAZPwC+Cg7c:tcILWYeWDR9OC+W3pgK0AZY77c
Score9/10-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
avast_free_antivirus_setup_online.exe
-
Size
262KB
-
MD5
44307d956aba1776313c04cdf2e8133f
-
SHA1
6a2eddce24b0bc60b1082c00659525a02c3c3026
-
SHA256
9982dbc49578bdca4361782d98556fa8f213ad4c1e69c3bd8a351fc08984bfc4
-
SHA512
86d841e44aae8dde2cda2eba552b6c42bbaf1353e73c5e3f4b5abac2b055ba3081d1d62de89b5000179f6879b7f3a34e965ed95da8c4f2b5f92eb51e2ba00dce
-
SSDEEP
3072:K3FKK+qOLpWZOpHwOnxjhI1a29nMGkvmUCDzTObdPnF5od1Jc+mTSC/REMz5hMBv:K9+qOLoaXjhenMGmmUEebVF+uoi9y6tk
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Registers COM server for autorun
-
Sets service image path in registry
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
-
-
Target
torbrowser-install-win64-11.5.6_de.exe
-
Size
99.4MB
-
MD5
238b039fa7c0699f40ff51cb168effe7
-
SHA1
3acb4d945017a15807351967529395ddda74b95b
-
SHA256
8e3f475fc016230a30edb2c92e0ce584bab53476a28204397df5dcae0ddd6497
-
SHA512
672fd8c2dcf855270325d632a573276dce5996eac19e5d4ad6d3106196f5e6725a0c2f6d0c4047af39f20e7513b1c0e6e98e55dd6e4c92e2736adf371fd1791d
-
SSDEEP
3145728:JT1EW79ZSuSu+7GEsrb0CguDNbDtC375z/DY9EpcUWcE:JT1EGbSu+7GEsv0ePQ37BLFpj7E
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
-
-
Target
vlc-3.0.17.4-win64.exe
-
Size
41.5MB
-
MD5
c72cb56788f32cd6df87611151336808
-
SHA1
1a9849cef017377f9dbf7d971bc4d6938421a1af
-
SHA256
fda8cbf2ee876be4eb14d7affca3a0746ef4ae78341dbb589cbdddcf912db85c
-
SHA512
4de78b34f50669e2c93e25c004d8cc9626663b5b38e88140136558e59a972b42e8df87d222dd951d5d31c9d58d2598c318af41fe31a61da8ab3fb5be977c5ad7
-
SSDEEP
786432:n9ZyOsYMCkuYbEFgLlK+Qe61Ubvcl+oKtRlf/dF1OX3bkccKP4u:n9GYMCk63e7b0l8Rlf/kLvcKQu
Score8/10-
Executes dropped EXE
-
Registers COM server for autorun
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-