General
-
Target
Windows 10 Rounded.exe
-
Size
2.4MB
-
Sample
230210-werwsada7t
-
MD5
11ff322997d98d02afe198c20b613ff3
-
SHA1
48e70395f187454bddc01484a6cbcf1c5f1753fc
-
SHA256
9482be3fcb23242751dfc68c1f239c92de3999618ca2d3ae0d7c9f5f596876f4
-
SHA512
11cc64b00f741b44c73c835e6da3c103d4a690e1c6c009cd020967e870967f31bd2ad8851f4e0d2a2c6e964558665e84d33839f82db2e178053d7ffb5b191ee4
-
SSDEEP
49152:DXNPtf+dAGSXAZGxgF3Nr13EfePGBT5OHTdg5K6EnCN11Y:DPxD5g1p9keGLc+SH
Malware Config
Targets
-
-
Target
Windows 10 Rounded.exe
-
Size
2.4MB
-
MD5
11ff322997d98d02afe198c20b613ff3
-
SHA1
48e70395f187454bddc01484a6cbcf1c5f1753fc
-
SHA256
9482be3fcb23242751dfc68c1f239c92de3999618ca2d3ae0d7c9f5f596876f4
-
SHA512
11cc64b00f741b44c73c835e6da3c103d4a690e1c6c009cd020967e870967f31bd2ad8851f4e0d2a2c6e964558665e84d33839f82db2e178053d7ffb5b191ee4
-
SSDEEP
49152:DXNPtf+dAGSXAZGxgF3Nr13EfePGBT5OHTdg5K6EnCN11Y:DPxD5g1p9keGLc+SH
Score8/10-
Modifies Installed Components in the registry
-
Possible privilege escalation attempt
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Registers COM server for autorun
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-