76b6c15e545bc953441fc08fc4f1ba2e29b4beec53fa9d95f742da8049c7e993

General

Target
EndpointSetup (1).exe
Size 689KB
Sample260619-bvdc4sc19j
SHA256 76b6c15e545bc953441fc08fc4f1ba2e29b4beec53fa9d95f742da8049c7e993
MD5 cb98ac9401a64f5846ced26cdf518751
SHA1 10078dc38376616afd7c3d51513a6682b779e482
SHA512 171bff7c3d0c331ab9c25f8c38272f6b228e42e81a38f19c2e7f474ba02e5000a8d6ec10da74db4ec5d8d129e5203061197f768c782e678e484c3806834918a7
SSDEEP 12288:dO1YiLJzK5xo+B+LpmSfuDupBHf874MtflkfMhk:dsk5K+B+wSfcupJ874M9iES
TLSH
T116E46B22B6E1C236D1235130996492A555BA6C60CB358FCB73CC7F1D6F326C19A32F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  EndpointSetup (1).exe
- Size 689KB
- SHA256 76b6c15e545bc953441fc08fc4f1ba2e29b4beec53fa9d95f742da8049c7e993
- MD5 cb98ac9401a64f5846ced26cdf518751
- SHA1 10078dc38376616afd7c3d51513a6682b779e482
- SHA512 171bff7c3d0c331ab9c25f8c38272f6b228e42e81a38f19c2e7f474ba02e5000a8d6ec10da74db4ec5d8d129e5203061197f768c782e678e484c3806834918a7
- SSDEEP 12288:dO1YiLJzK5xo+B+LpmSfuDupBHf874MtflkfMhk:dsk5K+B+wSfcupJ874M9iES
- TLSH
  T116E46B22B6E1C236D1235130996492A555BA6C60CB358FCB73CC7F1D6F326C19A32F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution macro persistence privilege_escalation spyware stealer trojan xlm
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Suspicious Office macro
  Office document equipped with 4.0 macros.
  macro xlm
- Creates new service(s)
  persistence execution
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2