3ffef90315dd0603a5b48841f24b9978bcb9a783bd5e7b94ff0ce9619f6cb085

General

Target
cel.exe
Size 18.4MB
Sample260701-w3vycact8q
SHA256 3ffef90315dd0603a5b48841f24b9978bcb9a783bd5e7b94ff0ce9619f6cb085
MD5 8c59b5ccb30aab97f76270d944c215cf
SHA1 e2598c785a1c5dc4e99c7a00faf9303fcf60dc1b
SHA512 ac20b6ac709135c77c24637ca500e56560faed9639fcd1109b14f027466148d03206ba763ab6d866a0c3c9166b6db8951767e7afad1636f6e34c639f44ea1c46
SSDEEP 393216:tdc2XdRJyJhp5LpqeI5aSstY9XXiQv7SoXA/7Tins:rcKwLwcRwnigTwjT6
TLSH
T1FA17335DFA916BECDA6EC5B20D880719E272281803B1C5DF77D2ADD56E336CC4E21722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  cel.exe
- Size 18.4MB
- SHA256 3ffef90315dd0603a5b48841f24b9978bcb9a783bd5e7b94ff0ce9619f6cb085
- MD5 8c59b5ccb30aab97f76270d944c215cf
- SHA1 e2598c785a1c5dc4e99c7a00faf9303fcf60dc1b
- SHA512 ac20b6ac709135c77c24637ca500e56560faed9639fcd1109b14f027466148d03206ba763ab6d866a0c3c9166b6db8951767e7afad1636f6e34c639f44ea1c46
- SSDEEP 393216:tdc2XdRJyJhp5LpqeI5aSstY9XXiQv7SoXA/7Tins:rcKwLwcRwnigTwjT6
- TLSH
  T1FA17335DFA916BECDA6EC5B20D880719E272281803B1C5DF77D2ADD56E336CC4E21722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion trojan adware collection discovery execution impact persistence privilege_escalation ransomware spyware
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2