bf066388ba859d290970a6011de59455dcaa6059b0ca120213b0b601ffe59369

Resubmissions

01-12-2024 18:15

241201-wwd19axqbx 10

01-12-2024 18:07

241201-wqgj7axpct 10

Sharing

Copy URL

Twitter E-mail

General

Target

KiPoypXaweM.rar
Size

148.6MB
Sample

241201-wwd19axqbx
MD5

b3503788b45b0d37179147d39219a223
SHA1

e0374d6e75205a8bf60cc73af6a8d403e9dccbc1
SHA256

bf066388ba859d290970a6011de59455dcaa6059b0ca120213b0b601ffe59369
SHA512

c2f51ce89a2390c6c3e6354015e6385678640f68896c7bad41953c16169a28e64d916fb0c81b0482567c1fc0f3324839b8cca5cdec02d2ea107bf5ca220e5eda
SSDEEP

3145728:Vf2l1ouOT92QSfrA6D6CTSmjSRwzWkmwLKkY9UaAv7:VIDW06MXjSR+m1fAv7

Score

10^/10

Malware Config

Targets

- Target
  
  KiPoypXaweM/NVIDIA.exe
- Size
  
  59.5MB
- MD5
  
  e9411904a5793c0accdfe6c04f188f54
- SHA1
  
  1685b9afcd93937f56a7f8a34d39bd5e3f2d201b
- SHA256
  
  04bc993d4352f2bda8ea5f9d8cf124711b4b5ad82329a64c97fd325f22c6ed98
- SHA512
  
  052ac21a92072846107d5785127cb6b47a1cd45b3dc2bf317ade84b6ec6e252d7afd2bf562ef2efe483c4eda632aa808b512cebc3d10b9bcb77a3ff452ed7ef1
- SSDEEP
  
  786432:4CAq85qFp3n4/14bJ7spyKbb3vhgnG/GYdXW+nZq4Hw3MutfvvTBlA1l3apTyB5a:zc14t0rGGeH+ZqmwMYNq1l3a4BT6CGO
Score

8^/10

discovery evasion execution persistence privilege_escalation
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  
  KiPoypXaweM/Requirements/Defender Control/Defender Control.exe
- Size
  
  447KB
- MD5
  
  58008524a6473bdf86c1040a9a9e39c3
- SHA1
  
  cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA256
  
  1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- SHA512
  
  8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP
  
  6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
Score

10^/10

defense_evasion discovery evasion execution persistence trojan upx
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  
  KiPoypXaweM/Requirements/Defender Control/Defender_Settings.vbs
- Size
  
  313B
- MD5
  
  b0bf0a477bcca312021177572311e666
- SHA1
  
  ea77332d7779938ae8e92ad35d6dea4f4be37a92
- SHA256
  
  af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
- SHA512
  
  09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3
- Target
  
  KiPoypXaweM/Requirements/OverwolfInstaller.exe
- Size
  
  2.1MB
- MD5
  
  66e3c44515e5eddfdd0c05140608bb3d
- SHA1
  
  03b432566f443359c195394dd588ca24face2f98
- SHA256
  
  257d09cca8254d6ee495fb30c596417574effc54084a8bfee6b5e5e5a957de7c
- SHA512
  
  a18f536e1e75700805cdc47d2e73dabb21d17563a1c20b32feee94779795987486eb652c58adf0fa1d875aaba9d5458b5198f299dc4d4195cb04fc089ab0be19
- SSDEEP
  
  49152:NnnQYKJxE87vxpsrFpIvFbJo+McPe3ps7DYOcNvxicbs:NntgPN+TIvFby0e5qcOT
Score

5^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral4
- Target
  
  $PLUGINSDIR/app/js/windows/progress/template.js
- Size
  
  242B
- MD5
  
  92b145e6649ba0add3dee9a69d3fa91e
- SHA1
  
  4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d
- SHA256
  
  a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab
- SHA512
  
  747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751
Score

3^/10

execution
behavioral5
- Target
  
  $PLUGINSDIR/app/js/windows/settings/settings-controller.js
- Size
  
  6KB
- MD5
  
  378c18dd7d5cee6ca7c4ddd0396b535b
- SHA1
  
  d5f81d4fab29201fd1629dc4d8e6f918c0c30479
- SHA256
  
  b5c5dc5e0684fd97eb4c45896dc1c2de8a6a6fdc63b6aa83a99103c15787ef35
- SHA512
  
  c29416b3f0245f4826d857dc8c52c969071d2410c945bda96f38f59a9bc7137ee534d84865e5ac55a1e3cea6bb705c5d592725af709cd97e7f38ff05dbaafe5b
- SSDEEP
  
  96:5RFTr5TvuTlpwWXs/t2V9OqIJ6OFGR+4V6RjTmoSrOlidbtmfPNVC8V/pGHmI4Rj:5RFBjugWX8YV9UAf+4CeoSrGWmNh
Score

3^/10

execution
behavioral6
- Target
  
  $PLUGINSDIR/app/js/windows/settings/template.js
- Size
  
  4KB
- MD5
  
  28513de0830383a516028e4a6e7585a0
- SHA1
  
  d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5
- SHA256
  
  8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f
- SHA512
  
  0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61
- SSDEEP
  
  48:Zx8LQmDdbaoFRpm4+0A2AEeQmDdbaoFCpm4+0A2AW:wpm4+5nHym4+5nW
Score

3^/10

execution
behavioral7
- Target
  
  $PLUGINSDIR/app/js/windows/welcome/template.js
- Size
  
  1KB
- MD5
  
  17f54fca6723b983875d940d931e0afb
- SHA1
  
  01774cd5cea36bd74c80a708d6f77567e8091024
- SHA256
  
  42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb
- SHA512
  
  401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038
Score

3^/10

execution
behavioral8
- Target
  
  $PLUGINSDIR/app/js/windows/welcome/welcome-controller.js
- Size
  
  2KB
- MD5
  
  50f676754862a2ab47a582dd4d79ecf3
- SHA1
  
  1cb2f4b11f9f8cfc8dc57ff29d0256dec4811158
- SHA256
  
  6155691dbdd66290109afb91617f9cf68af6bd912991d5d27b922f5faa7f530b
- SHA512
  
  ccfc89e08fd36f0a694fcda17efb84ca285b6c62afe2e3a794fdad19b6882a4b618645f4d9171673ba56fb4c55fce336d6b8d26dec3a5cc11293ae2b211f499f
Score

3^/10

execution
behavioral9
- Target
  
  $PLUGINSDIR/app/progress.html
- Size
  
  20KB
- MD5
  
  359ae05967ebe29e7f7a3564f0fa3f53
- SHA1
  
  3c1a454e8f5445ec890c5c2c11fa9e24bbb8e4bc
- SHA256
  
  f2182497ffe118349d8a462cf0eef55f22798a17e91846b194b7298d860ae38b
- SHA512
  
  0b61dd5af6feef3e1361a9ddc32dfca2200af44507f8f4e2c0f73ebdcb79e690d1f7561d86bbcace1ba16c37f18d6d40670de2d3e16b88d710180665de51675f
- SSDEEP
  
  192:dXdqpDNDPkFHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ/Hab48JgJnc5w/93mJ8F:d8WNaM8UnbjPaeu1JE36+
Score

4^/10

discovery
behavioral10
- Target
  
  $PLUGINSDIR/log4net.dll
- Size
  
  270KB
- MD5
  
  f15c8a9e2876568b3910189b2d493706
- SHA1
  
  32634db97e7c1705286cb1ac5ce20bc4e0ec17af
- SHA256
  
  ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309
- SHA512
  
  805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e
- SSDEEP
  
  3072:F+8gmdoxSO7ZbQFroo7RVir/dtnK0sgdnogtHcU5qFG1RSGCkE9kKn7GCcaLoWnS:I1N8LLI/PK0scnodG1RS1T93caLQD
Score

1^/10
behavioral11
- Target
  
  $PLUGINSDIR/nsProcess.dll
- Size
  
  14KB
- MD5
  
  10e47e822b85d2a12fa4727001612182
- SHA1
  
  12826a0cc7103e13f9be20a00ecc2c0fc995d2d5
- SHA256
  
  d530589a90918334b8e08d7355630892dd62f41333d948a860735d5becfcb391
- SHA512
  
  1ca0fa5d3727c23bdf5cf3123bc784070a93982e11e3fd1a875712ee3422730c0fba54a121aa814585466ba837f8122bc72b39c08de07d8ad369ced5155955f7
- SSDEEP
  
  192:jUl64IGsjBIYiYF8tO7zBNUjgA5K+o/y2sE9jBF0NyAa53Ug:QZwIYiPWBNUkAM+o/8E9VF0NyD9Ug
Score

3^/10

discovery
behavioral12
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  96KB
- MD5
  
  578471d002ef3fda8651c31e8b0088ca
- SHA1
  
  d2ecfe305dc0d5fcd00774c8a3870aa96b52ef95
- SHA256
  
  3f0c246bb78029d3d93b3766771b161e9bfcc153f6a59ad5acc48490971f39c9
- SHA512
  
  c9f6f60feee9b3d49c18d63a818c43c6c5d10786f01a0307a170452c54743099e6b227c967d28f0d797796512a9b708b47c27f9081b69144209b9b95144fb7ad
- SSDEEP
  
  3072:B4W0KMrKri9UX0X8Z365LUqXYwBleqleoutQSyEkr:01ZXqK5L3XsoS+xr
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13
- Target
  
  $PLUGINSDIR/nsis7z64.dll
- Size
  
  514KB
- MD5
  
  284c46af1fd2ec3a60ee0c28f276f2a4
- SHA1
  
  4d4d41c0af12d928e4e553ab6b80e6b4ab8007bc
- SHA256
  
  2368be6d8b21e0047146d3f61f90966a71d0737eed0146bc692b59f3cac97793
- SHA512
  
  ca9e4ef79c9c7c5f2282ddeee34ec39a51cddf26dcad4e9f2e42230499b0b898ac2dfd33f25438aa995741d23037fa01a0269823c283b234ecec0f155d3c05ec
- SSDEEP
  
  6144:C5IQHIy4gGVccVSVwp78nPfRvFbVWHWWDwkUzF2C/GJAiLwQ9r1uykJE6KizMSZJ:eIQHIXVL8g7EW2z4oGJ4gr8FzvJ
Score

1^/10
behavioral14
- Target
  
  $PLUGINSDIR/uac.dll
- Size
  
  24KB
- MD5
  
  861f7e800bb28f68927e65719869409c
- SHA1
  
  a12bfcd2b9950e758ead281a9afbf1895bf10539
- SHA256
  
  10a0e8cf46038ab3b2c3cf5dce407b9a043a631cbde9a5c8bcf0a54b2566c010
- SHA512
  
  f2bf24a0da69bbe4b4a0f0b1bfc5af175a66b8bcc4f5cc379ed0b89166fa9ffe1e16206b41fca7260ac7f8b86f8695b76f016bb371d7642aa71e61e29a3976eb
- SSDEEP
  
  384:5GVY6ClGoWxXH75T1WVl83lLsFIYiPWc+6AM+o/8E9VF0NyOk:tBWxXH9TYqlAyYiPjAMxkEH
Score

3^/10

discovery
behavioral15
- Target
  
  $PLUGINSDIR/utils.dll
- Size
  
  58KB
- MD5
  
  c6b46a5fcdccbf3aeff930b1e5b383d4
- SHA1
  
  6d5a8e08de862b283610bad2f6ce44936f439821
- SHA256
  
  251ab3e2690562dcfcd510642607f206e6dcf626d06d94b74e1fa8297b1050a0
- SHA512
  
  97616475ef425421959489b650810b185488fcb02a1e90406b3014e948e66e5101df583815fd2be26d9c4d293a46b02ba4025426f743e682ed15d228f027f55c
- SSDEEP
  
  768:cmLFb5dc9LS+8dayUhaPxYkkLE53UEDNnxqWLb1pA26MbwYiPbAMxkEu:cmLFtd9+O0fkV7xpD6ww7Pbxy
Score

3^/10

discovery
behavioral16
- Target
  
  $PLUGINSDIR/websocket-sharp.dll
- Size
  
  270KB
- MD5
  
  bd907f40168a3bc1590ee1f22be99014
- SHA1
  
  bd3324408817dcfef89595fa2a78acc5497a3f3f
- SHA256
  
  0c55480ef4020fddb567cf4487c5a44077a966ec6079b19faecd3e69dd991ad4
- SHA512
  
  af669cabcdaf405dde0aa42e04c7ff2234121ff87112b3b30479d24e1f77e120be72e257c1e4d1b436882879cd8c4657634f6f155548f4aa48bdc8fb51ee0065
- SSDEEP
  
  6144:1QNVC/FesewE4JVcmOBj6ssqq70ZOAs3PPJPsgU2:r/MsaiVxOBnq7P
Score

1^/10
behavioral17
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/install_all.bat
- Size
  
  1KB
- MD5
  
  eb55aae630088c91b88d2bfae4115ea0
- SHA1
  
  1495c69946edca474fe30c2b713aacb9f03bbf3a
- SHA256
  
  492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17
- SHA512
  
  48e4a3fa644b1859131cfec782641aaee9938c88f939ca0509df0f4120b922187753ce7cd7d912d2f90108526ba34d767baa28c9eeeb25d43fff77d38ddfd882
Score

7^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral18
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x64.exe
- Size
  
  3.0MB
- MD5
  
  56eaf4e1237c974f6984edc93972c123
- SHA1
  
  ee916012783024dac67fc606457377932c826f05
- SHA256
  
  0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
- SHA512
  
  f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
- SSDEEP
  
  49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral19
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x86.exe
- Size
  
  2.6MB
- MD5
  
  ce2922f83fb4b170affce0ea448b107b
- SHA1
  
  b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
- SHA256
  
  4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
- SHA512
  
  e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
- SSDEEP
  
  49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral20
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x64.exe
- Size
  
  5.0MB
- MD5
  
  e2ada570911edaaae7d1b3c979345fce
- SHA1
  
  a7c83077b8a28d409e36316d2d7321fa0ccdb7e8
- SHA256
  
  b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665
- SHA512
  
  b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8
- SSDEEP
  
  98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral21
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x86.exe
- Size
  
  4.3MB
- MD5
  
  35da2bf2befd998980a495b6f4f55e60
- SHA1
  
  470640aa4bb7db8e69196b5edb0010933569e98d
- SHA256
  
  6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
- SHA512
  
  bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
- SSDEEP
  
  98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x64.exe
- Size
  
  9.8MB
- MD5
  
  c9d9eebccef20d637f193490cec05e79
- SHA1
  
  15d032d669078aa6f0f7fd1cbf4115a070bd034d
- SHA256
  
  cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223
- SHA512
  
  24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6
- SSDEEP
  
  196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral23
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x86.exe
- Size
  
  8.6MB
- MD5
  
  1801436936e64598bab5b87b37dc7f87
- SHA1
  
  28c54491be70c38c97849c3d8cfbfdd0d3c515cb
- SHA256
  
  67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
- SHA512
  
  0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c
- SSDEEP
  
  196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral24
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x64.exe
- Size
  
  6.9MB
- MD5
  
  3c03562b5af9ed347614053d459d7778
- SHA1
  
  1a5d93dddbc431ab27b1da711cd3370891542797
- SHA256
  
  681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064
- SHA512
  
  6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75
- SSDEEP
  
  98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral25
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x86.exe
- Size
  
  6.3MB
- MD5
  
  7f52a19ecaf7db3c163dd164be3e592e
- SHA1
  
  96b377a27ac5445328cbaae210fc4f0aaa750d3f
- SHA256
  
  b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
- SHA512
  
  60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b
- SSDEEP
  
  196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral26
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x64.exe
- Size
  
  6.9MB
- MD5
  
  49b1164f8e95ec6409ea83cdb352d8da
- SHA1
  
  1194e6bf4153fa88f20b2a70ac15bc359ada4ee2
- SHA256
  
  a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
- SHA512
  
  29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60
- SSDEEP
  
  196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral27
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x86.exe
- Size
  
  6.2MB
- MD5
  
  38a1b890ce847167d16567cf7b7a5642
- SHA1
  
  0f5d66bcaf120f2d3f340e448a268fe4bbf7709d
- SHA256
  
  53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
- SHA512
  
  907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd
- SSDEEP
  
  196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral28
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2015_2017_2019_2022_x64.exe
- Size
  
  24.2MB
- MD5
  
  1d545507009cc4ec7409c1bc6e93b17b
- SHA1
  
  84c61fadf8cd38016fb7632969b3ace9e54b763a
- SHA256
  
  3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
- SHA512
  
  5935b69f5138ac3fbc33813c74da853269ba079f910936aefa95e230c6092b92f6225bffb594e5dd35ff29bf260e4b35f91adede90fdf5f062030d8666fd0104
- SSDEEP
  
  786432:tSp+Ty2SfUfnbDDko5dFMYqlQbgAVLSElbmucMuZZxs6Sf:4p+Ty2SfWnHDk8FjVbfzPTq4
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral29
- Target
  
  KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2015_2017_2019_2022_x86.exe
- Size
  
  13.2MB
- MD5
  
  8457542fd4be74cb2c3a92b3386ae8e9
- SHA1
  
  198722b4f5fc62721910569d9d926dce22730c22
- SHA256
  
  a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
- SHA512
  
  91a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182
- SSDEEP
  
  393216:x3RwlptVYmfr7yBG/4uOzH01/Nc1eJ/RXZMPDyiX:xGpttD7yBG/jx1/N/tZUDJ
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral30
- Target
  
  KiPoypXaweM/Requirements/Windows Update Blocker/Windows Update Blocker.exe
- Size
  
  939KB
- MD5
  
  9d6778f7f274f7ecd4e7e875a7268b64
- SHA1
  
  452fa439f1cc0b9fcc37cf4b8cfff96e8cc348aa
- SHA256
  
  187eeee9e518011de1b87cfb0ed03e12ea551e9011f0c8defdd0e4535e672da2
- SHA512
  
  d51df55a5f903ec624550e847459bfa52fb19e892a58fe2de41251d9d98890b36f26a4950ad75f900de0311b5330066aaece11ec5e549d5b3867a61a344e0b87
- SSDEEP
  
  24576:12DW/xbqX2YIbzQsu3/PNLIQFHyBvGThpZY9:12EmXGQsW/PN0QNlZI
Score

10^/10

evasion
- Modifies security service
  evasion
behavioral31
- Target
  
  KiPoypXaweM/Requirements/dxwebsetup.exe
- Size
  
  288KB
- MD5
  
  2cbd6ad183914a0c554f0739069e77d7
- SHA1
  
  7bf35f2afca666078db35ca95130beb2e3782212
- SHA256
  
  2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
- SHA512
  
  ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
- SSDEEP
  
  6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral32