0071706aab442e96fed3426d79b225c146277af8b784b11e02c0b445df2d2667

General

Target
browser.3604.msi
Size 175.8MB
Sample260523-qqn2dacy9v
SHA256 0071706aab442e96fed3426d79b225c146277af8b784b11e02c0b445df2d2667
MD5 035f1044c0967dce10e4a7d4c8075ea6
SHA1 bb6bc6c97827eb6fea732b40868913f304064660
SHA512 5d0adea5f79c751574a93b18c76708d28048c2211566e804b7584f51e21dcd85fd0a61b8e1f6a7d2213ff649913dc1e2f5280321e963410830539038c31251a6
SSDEEP 3145728:rw/dhBiz5R0Ovjwy9LjNtsDbaRJBDtXg/js0gn9EQcGCBZTI19H8F/w6BFxYc0sf:rKp0Rh/LhBksNQGCbTI19HslopE
TLSH
T1409833353556803AD4EA48FEAAB857B68D393F193B426601C330F95D007F7EB58F1A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  browser.3604.msi
- Size 175.8MB
- SHA256 0071706aab442e96fed3426d79b225c146277af8b784b11e02c0b445df2d2667
- MD5 035f1044c0967dce10e4a7d4c8075ea6
- SHA1 bb6bc6c97827eb6fea732b40868913f304064660
- SHA512 5d0adea5f79c751574a93b18c76708d28048c2211566e804b7584f51e21dcd85fd0a61b8e1f6a7d2213ff649913dc1e2f5280321e963410830539038c31251a6
- SSDEEP 3145728:rw/dhBiz5R0Ovjwy9LjNtsDbaRJBDtXg/js0gn9EQcGCBZTI19H8F/w6BFxYc0sf:rKp0Rh/LhBksNQGCbTI19HslopE
- TLSH
  T1409833353556803AD4EA48FEAAB857B68D393F193B426601C330F95D007F7EB58F1A4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan
- UAC bypass
  defense_evasion trojan
- Renames multiple (156) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1