04adafad485b6d1b72ccdd2714f5d47bbecb571225d3690714664c8aed34dad1

Sharing

Copy URL

Twitter E-mail

General

Target

PERM 11-12-2024.rar
Size

137.9MB
Sample

241212-wenjcs1rdv
MD5

f9af754b2b9e98cfb18e6216af2da080
SHA1

017f38b1758431fd1ec973abe3ef95c722377226
SHA256

04adafad485b6d1b72ccdd2714f5d47bbecb571225d3690714664c8aed34dad1
SHA512

07ab4868240836454a11f76e40f88744874e88818267617d9e7cedc0ccb666d5b247508e6f3378f72b28511ee07196065d36619a29f637caecc37efd6d4395c7
SSDEEP

3145728:p2ZPsZpy1/ktbFGNqHmGrh8CDgr8R+te6h4dv0uwLH1:wZPs7yKbS3CURtjOVwLV

Score

10^/10

Malware Config

Targets

- Target
  
  PERM 11-12-2024/Requirement's/Defender Control/Defender Control.exe
- Size
  
  447KB
- MD5
  
  58008524a6473bdf86c1040a9a9e39c3
- SHA1
  
  cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA256
  
  1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- SHA512
  
  8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP
  
  6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
Score

10^/10

defense_evasion discovery evasion execution persistence trojan upx
- Modifies security service
  evasion
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  
  PERM 11-12-2024/Requirement's/Defender Control/Defender_Settings.vbs
- Size
  
  313B
- MD5
  
  b0bf0a477bcca312021177572311e666
- SHA1
  
  ea77332d7779938ae8e92ad35d6dea4f4be37a92
- SHA256
  
  af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
- SHA512
  
  09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral2
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/install_all.bat
- Size
  
  1KB
- MD5
  
  eb55aae630088c91b88d2bfae4115ea0
- SHA1
  
  1495c69946edca474fe30c2b713aacb9f03bbf3a
- SHA256
  
  492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17
- SHA512
  
  48e4a3fa644b1859131cfec782641aaee9938c88f939ca0509df0f4120b922187753ce7cd7d912d2f90108526ba34d767baa28c9eeeb25d43fff77d38ddfd882
Score

7^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral3
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2005_x64.exe
- Size
  
  3.0MB
- MD5
  
  56eaf4e1237c974f6984edc93972c123
- SHA1
  
  ee916012783024dac67fc606457377932c826f05
- SHA256
  
  0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
- SHA512
  
  f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
- SSDEEP
  
  49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2005_x86.exe
- Size
  
  2.6MB
- MD5
  
  ce2922f83fb4b170affce0ea448b107b
- SHA1
  
  b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
- SHA256
  
  4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
- SHA512
  
  e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
- SSDEEP
  
  49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
Score

7^/10

discovery persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2008_x64.exe
- Size
  
  5.0MB
- MD5
  
  e2ada570911edaaae7d1b3c979345fce
- SHA1
  
  a7c83077b8a28d409e36316d2d7321fa0ccdb7e8
- SHA256
  
  b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665
- SHA512
  
  b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8
- SSDEEP
  
  98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral6
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2008_x86.exe
- Size
  
  4.3MB
- MD5
  
  35da2bf2befd998980a495b6f4f55e60
- SHA1
  
  470640aa4bb7db8e69196b5edb0010933569e98d
- SHA256
  
  6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
- SHA512
  
  bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
- SSDEEP
  
  98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2010_x64.exe
- Size
  
  9.8MB
- MD5
  
  c9d9eebccef20d637f193490cec05e79
- SHA1
  
  15d032d669078aa6f0f7fd1cbf4115a070bd034d
- SHA256
  
  cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223
- SHA512
  
  24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6
- SSDEEP
  
  196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral8
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2010_x86.exe
- Size
  
  8.6MB
- MD5
  
  1801436936e64598bab5b87b37dc7f87
- SHA1
  
  28c54491be70c38c97849c3d8cfbfdd0d3c515cb
- SHA256
  
  67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
- SHA512
  
  0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c
- SSDEEP
  
  196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral9
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2012_x64.exe
- Size
  
  6.9MB
- MD5
  
  3c03562b5af9ed347614053d459d7778
- SHA1
  
  1a5d93dddbc431ab27b1da711cd3370891542797
- SHA256
  
  681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064
- SHA512
  
  6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75
- SSDEEP
  
  98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral10
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2012_x86.exe
- Size
  
  6.3MB
- MD5
  
  7f52a19ecaf7db3c163dd164be3e592e
- SHA1
  
  96b377a27ac5445328cbaae210fc4f0aaa750d3f
- SHA256
  
  b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
- SHA512
  
  60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b
- SSDEEP
  
  196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral11
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2013_x64.exe
- Size
  
  6.9MB
- MD5
  
  49b1164f8e95ec6409ea83cdb352d8da
- SHA1
  
  1194e6bf4153fa88f20b2a70ac15bc359ada4ee2
- SHA256
  
  a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
- SHA512
  
  29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60
- SSDEEP
  
  196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral12
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2013_x86.exe
- Size
  
  6.2MB
- MD5
  
  38a1b890ce847167d16567cf7b7a5642
- SHA1
  
  0f5d66bcaf120f2d3f340e448a268fe4bbf7709d
- SHA256
  
  53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
- SHA512
  
  907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd
- SSDEEP
  
  196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral13
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2015_2017_2019_2022_x64.exe
- Size
  
  24.5MB
- MD5
  
  223a76cd5ab9e42a5c55731154b85627
- SHA1
  
  38b647d37b42378222856972a1e22fbd8cf4b404
- SHA256
  
  1821577409c35b2b9505ac833e246376cc68a8262972100444010b57226f0940
- SHA512
  
  20e2d7437367cb262ce45184eb4d809249fe654aa450d226e376d4057c00b58ecfd8834a8b5153eb148960ffc845bed1f0943d5ff9a6fc1355b1503138562d8d
- SSDEEP
  
  786432:tJJpx5hYBug51Mn8li64kgE1HeaPdjMDL1JZ:tpx56Bu61AH64kgsP2h
Score

4^/10

discovery
behavioral14
- Target
  
  PERM 11-12-2024/Requirement's/Visual-C-Runtimes-All-in-One-Nov-2024/vcredist2015_2017_2019_2022_x86.exe
- Size
  
  13.3MB
- MD5
  
  8a6f4f3282236325360a9ac4413b7bc3
- SHA1
  
  cb617803813e969be73f2e0e175a67620e53aa59
- SHA256
  
  dd1a8be03398367745a87a5e35bebdab00fdad080cf42af0c3f20802d08c25d4
- SHA512
  
  2c1facb8567a052b4fa65d173b0bda64fa5fded2cddb9073b7c28507ed95414c17d2839d06d5e961617c754cda54d6134964b1aff5c9e9cdfbace71f1de2ac3a
- SSDEEP
  
  196608:7LZ7uflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4D31by0AOGhX4/vxaT2CyMTl2:BklptVYmfr7yBG/4DlTs12GTl2
Score

4^/10

discovery
behavioral15
- Target
  
  PERM 11-12-2024/Requirement's/Windows Update Blocker/Windows Update Blocker.exe
- Size
  
  939KB
- MD5
  
  9d6778f7f274f7ecd4e7e875a7268b64
- SHA1
  
  452fa439f1cc0b9fcc37cf4b8cfff96e8cc348aa
- SHA256
  
  187eeee9e518011de1b87cfb0ed03e12ea551e9011f0c8defdd0e4535e672da2
- SHA512
  
  d51df55a5f903ec624550e847459bfa52fb19e892a58fe2de41251d9d98890b36f26a4950ad75f900de0311b5330066aaece11ec5e549d5b3867a61a344e0b87
- SSDEEP
  
  24576:12DW/xbqX2YIbzQsu3/PNLIQFHyBvGThpZY9:12EmXGQsW/PN0QNlZI
Score

10^/10

evasion
- Modifies security service
  evasion
behavioral16
- Target
  
  PERM 11-12-2024/Requirement's/dxwebsetup.exe
- Size
  
  288KB
- MD5
  
  2cbd6ad183914a0c554f0739069e77d7
- SHA1
  
  7bf35f2afca666078db35ca95130beb2e3782212
- SHA256
  
  2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
- SHA512
  
  ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
- SSDEEP
  
  6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral17
- Target
  
  PERM 11-12-2024/Serial Checker.bat
- Size
  
  1KB
- MD5
  
  c6b62b1ffcd5a9cade299e6a9458fd09
- SHA1
  
  8fbca3f3dab7aa83c19a284ffd0e168313768963
- SHA256
  
  cd8eb671af25c123a24436878e375df9b12e2465500d8f3fe20bcd51c2969de4
- SHA512
  
  27b789862c56103753af9860299fb01d76579b0983d6d0617671401a2d50dc4d4ed224c26360a660680b3f1bf3252c3de41cc088c359b851102b0da53b8efae9
Score

3^/10

execution
behavioral18
- Target
  
  PERM 11-12-2024/Updater.exe
- Size
  
  49.1MB
- MD5
  
  f0b6329b9fb24e78303edf1b63235179
- SHA1
  
  d38813c27e5ce75378f86a2612b6c8c450c31ce3
- SHA256
  
  9c99152179e5da930aa6a38b737797083374452c67d09e612e193ea6ae60ac36
- SHA512
  
  222dc14217320cf899191d0d47a1706208e68553ad34b3d511b26762aef209eb89879c070e8376558d7300081574e9c5b149d50231adef2021aafc9d19b568eb
- SSDEEP
  
  1572864:iWTsb692piMo7VAe4yCwDcGS7T/ZqOBv+:iWgb647qcZqc9n91
Score

1^/10
behavioral19