18bae0cdfa50ee6b6e8053cb0e96dde3d01d318bbe48cb9d71627ed7bdddb852

General

Target
Adobe After Effects СС 2020.rar
Size 978.6MB
Sample260702-pnppfsgw5k
SHA256 18bae0cdfa50ee6b6e8053cb0e96dde3d01d318bbe48cb9d71627ed7bdddb852
MD5 37825c192e395c0286a73db5131184be
SHA1 8a169b95e969531ac36c27456eefa5d8057f80c2
SHA512 6f63719781ddc82b294636e7f3137fc20a1efd448db89c43fc2d57e62ebee741cf9f21cce95c6e1a403b6a13a7a009aa4729c805b5234f0d5ff84824b2ad3dce
SSDEEP 12582912:bs+nu7ITQCWg78vQgu9c1D6fDiHVB2tHl0zyCxZmmZJN1olQivc+F529+PJfCEJ:rNTQC18RacGVMzpemTYmiU+mEJ
TLSH
T18EB933EEB0ED38A8A1F4379518C66DDAC3990FA6318DB959738C3F45107461A5C8BFB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Adobe After Effects СС 2020.rar
- Size 978.6MB
- SHA256 18bae0cdfa50ee6b6e8053cb0e96dde3d01d318bbe48cb9d71627ed7bdddb852
- MD5 37825c192e395c0286a73db5131184be
- SHA1 8a169b95e969531ac36c27456eefa5d8057f80c2
- SHA512 6f63719781ddc82b294636e7f3137fc20a1efd448db89c43fc2d57e62ebee741cf9f21cce95c6e1a403b6a13a7a009aa4729c805b5234f0d5ff84824b2ad3dce
- SSDEEP 12582912:bs+nu7ITQCWg78vQgu9c1D6fDiHVB2tHl0zyCxZmmZJN1olQivc+F529+PJfCEJ:rNTQC18RacGVMzpemTYmiU+mEJ
- TLSH
  T18EB933EEB0ED38A8A1F4379518C66DDAC3990FA6318DB959738C3F45107461A5C8BFB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution installer persistence privilege_escalation spyware trojan upx
- Modifies Windows Firewall
  defense_evasion
- Deletes itself
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1