8d6b1efca7001c82c08ced77c5a1b216562099572122a1aa1536a6b429d0590e

General

Target
SAP-GUI-770.zip
Size 419.8MB
Sample260511-rllacsb171
SHA256 8d6b1efca7001c82c08ced77c5a1b216562099572122a1aa1536a6b429d0590e
MD5 353e712a1e49c67c4383f626b7948faf
SHA1 66b12bbfe91ce8333ed14d15f022e207d7971483
SHA512 49e0c5a8e2b849cc9ebec2a515eb301c0af5bf1ac30d8632be297403ac2f826bbb3888e65872106d1ab05d19c827c00c26b6c19680905ce7b73f40813cd6acd5
SSDEEP 12582912:VPlF70N7AWTJbTBfMy/3/iT4eae/g024/bnQ+J3Ogao2DUx:rZ07HTttM2Pi0eaGgHwbnQ+J3Og92Qx
TLSH
T107293396FE44BE1ACE7F2C3491D1D90791D1814AC49B19E2B2588381BC6F6815FF8ECE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SAP-GUI-770/SapNwBcSetup.exe
- Size 280KB
- SHA256 dc6cbd83d58482883ba0d1e70b88d0d89c756f4c8a2bcd2f24778c326cbc4c33
- MD5 9854d36b53d21af044c825be7325f2bd
- SHA1 2db9e0cbea9a4350faa594d59b64eaab78d3fc6a
- SHA512 157abf48557f25eda24e6dadb6bda4a2cbcfb159b4c7278bede40228247e81aadf385c2f479df6a165ee3be461b88d3e0846e637b8ae999292b5f7a4fddf74af
- SSDEEP 3072:xgTBCJ/cm9jAJ5YouKG9SZrS0LbDYPm9rnNrqfA1amHuAg0FuzmGql4qRFGU2rdS:xuCx+6o1GcZr/vYPIbNjeAOzElFJus
- TLSH
  T190546C207992C436D573063109F8DBB6567EBD140F608EDF93C82F2E9E342D26A31E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery adware spyware
behavioral1 behavioral2
- Target
  SAP-GUI-770/setup/NwSapSetupIs.exe
- Size 527KB
- SHA256 349abc3bf17fbf246616ce6763a78e6271975f2bd972bf2c91597a519d5b5ae6
- MD5 5141777279f382f4de39bcefdf33b5de
- SHA1 71a1cc48043312c171de9187f60bf25c9bba870c
- SHA512 fb59bceb27ec12e7485c76891648661c154d74ae5557a23ef073c7532251c29aad7664f90709959f6f5bb6c45b744763cba916d34307f68ac99324f42382176e
- SSDEEP 12288:gffLmtNIrZKK6qGwcqY9UVLow0SYjnBJyK8sWFppUSdJGRY:0x6iYDBsKdWHGSjGq
- TLSH
  T1BBB46B10F6A6C236D07281B02D3CDB96507DBD285F7185DBB3C82E2E5AB45D25A32F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  SAP-GUI-770/setupall.exe
- Size 280KB
- SHA256 dc6cbd83d58482883ba0d1e70b88d0d89c756f4c8a2bcd2f24778c326cbc4c33
- MD5 9854d36b53d21af044c825be7325f2bd
- SHA1 2db9e0cbea9a4350faa594d59b64eaab78d3fc6a
- SHA512 157abf48557f25eda24e6dadb6bda4a2cbcfb159b4c7278bede40228247e81aadf385c2f479df6a165ee3be461b88d3e0846e637b8ae999292b5f7a4fddf74af
- SSDEEP 3072:xgTBCJ/cm9jAJ5YouKG9SZrS0LbDYPm9rnNrqfA1amHuAg0FuzmGql4qRFGU2rdS:xuCx+6o1GcZr/vYPIbNjeAOzElFJus
- TLSH
  T190546C207992C436D573063109F8DBB6567EBD140F608EDF93C82F2E9E342D26A31E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6