General
-
Target
f0702f55e2af158db7cc17026068493b3ac36a1503aec6ca67de769a77ad3e2f
-
Size
4.0MB
-
Sample
230203-ndf4wseg72
-
MD5
9b3479760d30adc8d195d49c3104fd87
-
SHA1
ad60c87741e4d219524ff9b9af9cbc0c9dd194e6
-
SHA256
f0702f55e2af158db7cc17026068493b3ac36a1503aec6ca67de769a77ad3e2f
-
SHA512
90912d9aa8839e749dd81b259ce7cd4a1fa4a789654528de966b7223c8b0b0e194d42660dbf009e4f886778be145cc8f77efaf2d4f026cce094272b3ba64431a
-
SSDEEP
49152:7v0l8b+aUXeV/1OAv6JYQKKuf8uPn0RGKouo17A8YNRvE0C7JGoY4sPkkCEW:Ql8K61xWYQKguPnFKoVvkvXC8cmW
Static task
static1
Malware Config
Targets
-
-
Target
f0702f55e2af158db7cc17026068493b3ac36a1503aec6ca67de769a77ad3e2f
-
Size
4.0MB
-
MD5
9b3479760d30adc8d195d49c3104fd87
-
SHA1
ad60c87741e4d219524ff9b9af9cbc0c9dd194e6
-
SHA256
f0702f55e2af158db7cc17026068493b3ac36a1503aec6ca67de769a77ad3e2f
-
SHA512
90912d9aa8839e749dd81b259ce7cd4a1fa4a789654528de966b7223c8b0b0e194d42660dbf009e4f886778be145cc8f77efaf2d4f026cce094272b3ba64431a
-
SSDEEP
49152:7v0l8b+aUXeV/1OAv6JYQKKuf8uPn0RGKouo17A8YNRvE0C7JGoY4sPkkCEW:Ql8K61xWYQKguPnFKoVvkvXC8cmW
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-