12aa22e32b2890505f36cb2fad781be4a5f990eabfb6b1bec3aebf7425e5e09e

General

Target
HWID Spoofer.zip
Size 5.4MB
Sample260707-wc2cfaa14s
SHA256 12aa22e32b2890505f36cb2fad781be4a5f990eabfb6b1bec3aebf7425e5e09e
MD5 5a50936e8dffeb0dbe8d634d1882c758
SHA1 eb9cc01383a3232bb9c030be10dab03e5f0b0334
SHA512 3cc9dc6eb2e75836e70b1f368cd6c2c1eb2f9209bfd5082a21d67ef4f05152d03aecf405a3f34b4712f3ff10aabdee5b85554b0e210868171f77cd08cad63397
SSDEEP 98304:bAX73IqKTeWFDvqrc+3vwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxJ:S/WFjsvw/tyd3w++lz0byJ
TLSH
T14D461227F28A647DE06B56354AB2911095377E216E128E4B97EC749CCF362A03E3F347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  HWID Spoofer.zip
- Size 5.4MB
- SHA256 12aa22e32b2890505f36cb2fad781be4a5f990eabfb6b1bec3aebf7425e5e09e
- MD5 5a50936e8dffeb0dbe8d634d1882c758
- SHA1 eb9cc01383a3232bb9c030be10dab03e5f0b0334
- SHA512 3cc9dc6eb2e75836e70b1f368cd6c2c1eb2f9209bfd5082a21d67ef4f05152d03aecf405a3f34b4712f3ff10aabdee5b85554b0e210868171f77cd08cad63397
- SSDEEP 98304:bAX73IqKTeWFDvqrc+3vwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxJ:S/WFjsvw/tyd3w++lz0byJ
- TLSH
  T14D461227F28A647DE06B56354AB2911095377E216E128E4B97EC749CCF362A03E3F347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  .Store
- Size 3.4MB
- SHA256 377abc9d367e61cb5c4761bf48dcfdf5bcd3822f303e0f972d7f4c8295a2ea79
- MD5 15596b41dba42cdcce4f677fbbc86b6e
- SHA1 1ed1e69e72028150f8562bff5ca1dd745874329a
- SHA512 d4e0d64f71027ecc6d85479542ed682359b37446cb1dccce5fa2972f152e27f3cb91a8ec0dc61270bc40038751a58982d4678efb929a3bc6d3546e072f51a9f2
- SSDEEP 98304:HwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxm:Hw/tyd3w++lz0bym
- TLSH
  T1CDF5234AF7951CF4E5A3E2758AA1450BE3737C563B3093CF2760566A2F232915E3E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  HWID Spoofer.exe
- Size 2.0MB
- SHA256 c9cd1f8749a4f7032ad7a18f7a2b2aa74d6af51022eeff7071bd0bf9228c0479
- MD5 d1c6b88b212b0bed3f430c4b7dfe8747
- SHA1 1b19bf42a2fc1bdc80d278c50ce3138720725e7d
- SHA512 baadd6d0350c13b3bea362c9658868bf396929eb95f7609c29538413df4a186edd6ff19e9b23358c372dd457019e0ff510256e3dd01e41eff1938083058a658e
- SSDEEP 49152:yAX7NFIUt1ITeLKFhVCsmMqrc+BG2L8dR:yAX73IqKTeWFDvqrc+3Y
- TLSH
  T19EA5D033F28AA53EE06E5A365AB29150543B7A616D138D0BD6EC389CCF352603D3B747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6