16ab5ac3ca306f4a433561b2f78ad96c46c0d4efee9183f0da8ed5a66c062e2e

General

Target
winsvc_fud.exe
Size 24.7MB
Sample260621-chnhzsb16w
SHA256 16ab5ac3ca306f4a433561b2f78ad96c46c0d4efee9183f0da8ed5a66c062e2e
MD5 313d2e32e0a7ba674a9e2e6a8763145b
SHA1 6647ed57aa7fdf62bb1b20eb4845687b5b7bb9b2
SHA512 6e7858bc0b1df8fa2daac3f6911c1591c87f2b52371f97185201ba8976191f799a56e6e5af706ce9a9ba7c0c4a82c4d55452160d9fde1b3014e8e46b39f2bea3
SSDEEP 786432:Hec1pRI9wrKvhW7Efukug2J1QtIMuAkax6DE3:Hemv+v+EJUniIMZk
TLSH
T1FF4733D4A2B316C5EEAB547893A39200F5E6F0578725D30B63542FC22F1BB316A36F25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  winsvc_fud.exe
- Size 24.7MB
- SHA256 16ab5ac3ca306f4a433561b2f78ad96c46c0d4efee9183f0da8ed5a66c062e2e
- MD5 313d2e32e0a7ba674a9e2e6a8763145b
- SHA1 6647ed57aa7fdf62bb1b20eb4845687b5b7bb9b2
- SHA512 6e7858bc0b1df8fa2daac3f6911c1591c87f2b52371f97185201ba8976191f799a56e6e5af706ce9a9ba7c0c4a82c4d55452160d9fde1b3014e8e46b39f2bea3
- SSDEEP 786432:Hec1pRI9wrKvhW7Efukug2J1QtIMuAkax6DE3:Hemv+v+EJUniIMZk
- TLSH
  T1FF4733D4A2B316C5EEAB547893A39200F5E6F0578725D30B63542FC22F1BB316A36F25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution impact persistence pyinstaller ransomware trojan adware spyware
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2