6a9b21db4e0b521a8fb2b56b2254b6ef80f5d95c44202124e932f44a856b4f33

General

Target
TechSmith Snagit 12.3.2 Build 2909.exe
Size 75.1MB
Sample260620-v9xvvahv5t
SHA256 6a9b21db4e0b521a8fb2b56b2254b6ef80f5d95c44202124e932f44a856b4f33
MD5 3f40744b023e9684841f52af96d0b5ef
SHA1 6f79ecd8bc5deec5a86293c19bce9b7df508166b
SHA512 7d8eb9a4a9de8c25f9d0bb46b5db53105fc73791758756769727bae8e37a55629d25f0dd7778db16ae54cf2120daba28f0c6ffbade809fdf6357b28187e233f9
SSDEEP 1572864:grVoBKgYUhNlhXE5rLFHam8CLwUSC5NeKtG7qM2TndI7qvU1foP4P1z:grAfhNl1EdwNCsUneGM27670Uttz
TLSH
T1580833CD6847713AE69239F1EDBE37759E0C3DC361BA1B9A4F7051924ABC681440BB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  TechSmith Snagit 12.3.2 Build 2909.exe
- Size 75.1MB
- SHA256 6a9b21db4e0b521a8fb2b56b2254b6ef80f5d95c44202124e932f44a856b4f33
- MD5 3f40744b023e9684841f52af96d0b5ef
- SHA1 6f79ecd8bc5deec5a86293c19bce9b7df508166b
- SHA512 7d8eb9a4a9de8c25f9d0bb46b5db53105fc73791758756769727bae8e37a55629d25f0dd7778db16ae54cf2120daba28f0c6ffbade809fdf6357b28187e233f9
- SSDEEP 1572864:grVoBKgYUhNlhXE5rLFHam8CLwUSC5NeKtG7qM2TndI7qvU1foP4P1z:grAfhNl1EdwNCsUneGM27670Uttz
- TLSH
  T1580833CD6847713AE69239F1EDBE37759E0C3DC361BA1B9A4F7051924ABC681440BB0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan upx
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  out.upx
- Size 635KB
- SHA256 194e678855c957c7cc07b59b2c50513b0e01e498cbd08ceeb0f49bc2e89d83f6
- MD5 4bfebd6a1c4d9d52d8e4c945275f8a49
- SHA1 46680d280cd26e64da6d9cfbd2e0c595751f6cd5
- SHA512 0ec77b1c814f5c25349e42f642804e34fd18adae8a45a0497d231267811f3e4ff8418b401898401dc9b46a23107e3100b1e48e8b09d892a5a09f13f139c5a785
- SSDEEP 12288:qhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJc:qRmJkcoQricOIQxiZY1
- TLSH
  T106D49F21F5C69036C2B323B19E7EF76A963D69360327D2D727C82C315EA05416A3A773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4