f62b331577ed2099ec46aa6e9f6e631a7224dbc50833d9ecee4741af9909415d

Target
393h7xabwrge1.jpeg
Size 5.2MB
Sample251116-tt2y7azqdn
SHA256 f62b331577ed2099ec46aa6e9f6e631a7224dbc50833d9ecee4741af9909415d
MD5 776e47a2add80cfab935a098af03a71e
SHA1 bd4e1bc7af1a426f5a215fd3efb575db1d0afd61
SHA512 5efdbe9cf26fe1f0a6c59d69edf81ecbdde1946a827354f4e8ee77880a607f208a48edb7e6d751b48aa7792593c4f627551b79035d5c254ffcdb64c2f7c00969
SSDEEP 49152:Yx+7k+/qoW0Fsj7BLfkmMeQEHi69E0kMDHSSi6Drj5izjs4pwcgPyUlOeAfQBxYK:YxS1QlkVnEyMl3diz4KI9MDYvpc+qmWS
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  393h7xabwrge1.jpeg
- Size 5.2MB
- SHA256 f62b331577ed2099ec46aa6e9f6e631a7224dbc50833d9ecee4741af9909415d
- MD5 776e47a2add80cfab935a098af03a71e
- SHA1 bd4e1bc7af1a426f5a215fd3efb575db1d0afd61
- SHA512 5efdbe9cf26fe1f0a6c59d69edf81ecbdde1946a827354f4e8ee77880a607f208a48edb7e6d751b48aa7792593c4f627551b79035d5c254ffcdb64c2f7c00969
- SSDEEP 49152:Yx+7k+/qoW0Fsj7BLfkmMeQEHi69E0kMDHSSi6Drj5izjs4pwcgPyUlOeAfQBxYK:YxS1QlkVnEyMl3diz4KI9MDYvpc+qmWS
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware bootkit microsoft defense_evasion discovery execution installer persistence phishing privilege_escalation ransomware spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Detected potential entity reuse from brand MICROSOFT.
  phishing microsoft
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2