94108bed7f7a12a203282b5cfd8e1c85127f5888a434d2b8bf2c558ffda032c7

General

Target
clippy.png
Size 12KB
Sample240502-vgnfpsda2y
SHA256 94108bed7f7a12a203282b5cfd8e1c85127f5888a434d2b8bf2c558ffda032c7
MD5 b3d02d1a6c98e7f958f54bebd1494f20
SHA1 ebb12e928eb675204a0975842f057904cba91fa3
SHA512 0ac44d8dffefcb0a670543a18c84ad357228f871fa5be3180994e5f148a5b56be01cd536befe617028ef6237bf093c44135ca1d15f3d1b243d7026cc9c648b88
SSDEEP 384:U3qq/5SNbChFzYg2jqM2skhaSbgaItj49r:Yj/oRChJYgM/hSbgaIt8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  clippy.png
- Size 12KB
- SHA256 94108bed7f7a12a203282b5cfd8e1c85127f5888a434d2b8bf2c558ffda032c7
- MD5 b3d02d1a6c98e7f958f54bebd1494f20
- SHA1 ebb12e928eb675204a0975842f057904cba91fa3
- SHA512 0ac44d8dffefcb0a670543a18c84ad357228f871fa5be3180994e5f148a5b56be01cd536befe617028ef6237bf093c44135ca1d15f3d1b243d7026cc9c648b88
- SSDEEP 384:U3qq/5SNbChFzYg2jqM2skhaSbgaItj49r:Yj/oRChJYgM/hSbgaIt8
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

adware discovery evasion persistence ransomware stealer trojan
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Modifies AppInit DLL entries
  persistence
- Modifies Installed Components in the registry
  persistence
- Modifies RDP port number used by Windows
- Registers new Print Monitor
  persistence
- Sets DLL path for service in the registry
  persistence
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Allows Network login with blank passwords
  Allows local user accounts with blank passwords to access device from the network.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1