Extracted

Extracted

• • Target

    RNSM00478.7z

  • Size

    50.7MB

  • MD5

    05dea7740e20c7ec86db20f5557b4b91

  • SHA1

    045949b5785793f1f2abba1862d31e4d25eb0de8

  • SHA256

    396daf1baf397e55a15bdb07b0ec41879d874c3b5e905c1afb85d7abde40902d

  • SHA512

    0ffdd032ffb0fdaeaaea7033b9c3feeb211709072410cf5ae809585fd1762741a7058c87f70c68aded89cddc8b30431eb1ca81a8dc7ec12df3f35ea346c4e854

  • SSDEEP

    786432:AR8z6Twpi1BeZkxxvhT1SrOn/a2onJvKE+xgKyYi/q168TQX0bemk76NUGZDX/QM:ARcGwMremxpFcC/12NL8Mk6l76mGdR

  Score

  10^/10

  hawkeyenanocorecollectiondiscoveryevasionexecutionkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojanupx

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Modifies WinLogon for persistence

    persistence

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1