c7687cba05cd8cadd69a1affee119e0e1b7019b44922a4cd16496da8c50e9419

General

Target
c7687cba05cd8cadd69a1affee119e0e1b7019b44922a4cd16496da8c50e9419
Size 1.2MB
Sample260702-khm68acz5p
SHA256 c7687cba05cd8cadd69a1affee119e0e1b7019b44922a4cd16496da8c50e9419
MD5 9cfd009775c3a4f5e7b126d7e62258cf
SHA1 be37eccfe42f2f80fbc4b43ae7313c1e0cbf8420
SHA512 d053cf715f6dd195c0cbde7f1b9b2b29f594b6ad88065946d0df0734ce4ec88c4b20acc4375b79c196fcdc3743687aa0c6f29eb215856278566590116cb4e89f
SSDEEP 24576:p+x+nfZW2IFJ3fiRUJmBTEGwtXVT7xk8nBxaHO/jUoBF:p+yZW2IFJ8yRvk8i
TLSH
T13E556C23E18284B1D11462F122F70B34ED78CB725D718A83E7D8EE756E62A71C76B14E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  c7687cba05cd8cadd69a1affee119e0e1b7019b44922a4cd16496da8c50e9419
- Size 1.2MB
- SHA256 c7687cba05cd8cadd69a1affee119e0e1b7019b44922a4cd16496da8c50e9419
- MD5 9cfd009775c3a4f5e7b126d7e62258cf
- SHA1 be37eccfe42f2f80fbc4b43ae7313c1e0cbf8420
- SHA512 d053cf715f6dd195c0cbde7f1b9b2b29f594b6ad88065946d0df0734ce4ec88c4b20acc4375b79c196fcdc3743687aa0c6f29eb215856278566590116cb4e89f
- SSDEEP 24576:p+x+nfZW2IFJ3fiRUJmBTEGwtXVT7xk8nBxaHO/jUoBF:p+yZW2IFJ8yRvk8i
- TLSH
  T13E556C23E18284B1D11462F122F70B34ED78CB725D718A83E7D8EE756E62A71C76B14E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx adware spyware
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  .rdata
- Size 180KB
- SHA256 43cc3110c441d88c85988f1ae4bbbbd3b5826156f90d9b2073e0513c248c2e63
- MD5 93321fb8519a222b16b08503a7a05d14
- SHA1 dbd53112a092528e36b337f8b94843969aa84b1e
- SHA512 08cd2a3c8bb1983d5df94fcafcf2d99e10ad3666301309f8d807f12b58431bace760e0ccbe214fa52aad98b9b4313caa7d469decc479ba6b53b5c5d9243586ef
- SSDEEP 3072:mUzxWivRTrwNt7y9iOJNx+UWxTUT0BnXXxprYj/DHxKVWe1nk:+i6v76tgUoBrrYj/DRKX
- TLSH
  T1F5044822B96AC1B3C0969030D6E75395E6A3F8014F224557728C573EFE23264973BBF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4