Extracted

Extracted

• • Target

    70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2

  • Size

    2.1MB

  • MD5

    ac2bf4a9c78fa484d14d45ebb20bb63d

  • SHA1

    0f2164ff2bfd617e2d37e847541a1ed7aacafe94

  • SHA256

    70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2

  • SHA512

    6a8191e115e8b99424cdaa0ade7b148c14782dfbea981692a106e6b66ae1dae474bae37571b542ae5992d263851f292f7731f3449750c6bbd2bde260671323bd

  • SSDEEP

    49152:DIqjmpWdn49S5w+z4BYAiaxs6v5fZ3RyGw0cobvZxC7yciIB:DBmpWdn4ww+z4mu5fNAGw0ZVEyciIB

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistencetrojan

  • Disables service(s)

    evasionexecution

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2