Extracted

• • Target
    _TrocadorDesktop%28V1.1.0%29.msi
  • Size 252KB
  • SHA256 7bda0aa187b2b11edec3f160b80d7e59b5fea34921592c7d9fe7efb3875e89c7
  • MD5 cd1b7c26bc3bcd149c64bdce609bf0cb
  • SHA1 2743b4c784b6a58ade09e60d56ef09183e1051e8
  • SHA512 f23bc0541d524e8c534890ae98aba8ae7e5237cc2fab25c99f98ef055070f9905b344712d449288bb4108547085a1e09b8fab46add434a0a7a14083668d266e1
  • SSDEEP 3072:vspAtOCmXwCGjtYNKbYO2gjpcm8rRuqpjCLP2loHUvUiyGxr59qM2a8Qb:ptOCiRQYpgjpjew52ZyGxTqo8o
  • TLSH
    T160446B513AC9C13AD29E063785BADB76263A7D710B30D0CF77907D6C9E316D2AA39342
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2