General
-
Target
4e576a1d03477fae4694f76f097e18cd8eff05fd36889912e9f353e8b9c6974b
-
Size
4.0MB
-
Sample
221127-1dra3saf39
-
MD5
45cf9263a284a1c339d20ecb16e5ffc1
-
SHA1
0ff8c91c1c8491b71f56a7dd5afc171906fe1ce3
-
SHA256
4e576a1d03477fae4694f76f097e18cd8eff05fd36889912e9f353e8b9c6974b
-
SHA512
5626fe007d74e643e9f91bc9290790a036bf84970e98ae3dcae2c1e5f61569c8ebf5532388fa493c4992b502e2f8d1a7a0cab52c757081cc46e4f3067cb10334
-
SSDEEP
98304:jwLKxEuBeKgM/cJXYAyfi0ZOC+2TVeu+II7TrkVS5:jwLY3BejMEG3i0E0VS5
Static task
static1
Malware Config
Targets
-
-
Target
4e576a1d03477fae4694f76f097e18cd8eff05fd36889912e9f353e8b9c6974b
-
Size
4.0MB
-
MD5
45cf9263a284a1c339d20ecb16e5ffc1
-
SHA1
0ff8c91c1c8491b71f56a7dd5afc171906fe1ce3
-
SHA256
4e576a1d03477fae4694f76f097e18cd8eff05fd36889912e9f353e8b9c6974b
-
SHA512
5626fe007d74e643e9f91bc9290790a036bf84970e98ae3dcae2c1e5f61569c8ebf5532388fa493c4992b502e2f8d1a7a0cab52c757081cc46e4f3067cb10334
-
SSDEEP
98304:jwLKxEuBeKgM/cJXYAyfi0ZOC+2TVeu+II7TrkVS5:jwLY3BejMEG3i0E0VS5
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-