5593330d791aca75cdd5dc752aa3efa9e958449f61edc38ea28e95f3b41d4995

General

Target
5593330d791aca75cdd5dc752aa3efa9e958449f61edc38ea28e95f3b41d4995.exe
Size 496KB
Sample260629-mcwbraax5v
SHA256 5593330d791aca75cdd5dc752aa3efa9e958449f61edc38ea28e95f3b41d4995
MD5 fd0d2ee46022d5d0228dba24f9cd36c1
SHA1 c845eeb8ca7176de497c1414c68bf32ad98dee77
SHA512 18fdc0b989cb54937ad91a313c5f581614860d5cfa4a610e68f3d2bee50e9818582856d5d3d7412a4f1b70fc28960019e25f30597c8a9a1bd6636ec74314df06
SSDEEP 12288:fX4Qiq8MhMwvww3r/6TPHWElAWoriCykqlOFVtGF3rPD:f4QCMhMwvf3ryTPBpoD1QOFuD
TLSH
T1D5B42225AB65C5B6C83A0531ED66C6FE57A9ED13E0F2270F63903D077834F82582B2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  5593330d791aca75cdd5dc752aa3efa9e958449f61edc38ea28e95f3b41d4995.exe
- Size 496KB
- SHA256 5593330d791aca75cdd5dc752aa3efa9e958449f61edc38ea28e95f3b41d4995
- MD5 fd0d2ee46022d5d0228dba24f9cd36c1
- SHA1 c845eeb8ca7176de497c1414c68bf32ad98dee77
- SHA512 18fdc0b989cb54937ad91a313c5f581614860d5cfa4a610e68f3d2bee50e9818582856d5d3d7412a4f1b70fc28960019e25f30597c8a9a1bd6636ec74314df06
- SSDEEP 12288:fX4Qiq8MhMwvww3r/6TPHWElAWoriCykqlOFVtGF3rPD:f4QCMhMwvf3ryTPBpoD1QOFuD
- TLSH
  T1D5B42225AB65C5B6C83A0531ED66C6FE57A9ED13E0F2270F63903D077834F82582B2B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4