3633507531344b06079124af605f93434969748d137b37a85136e46269862ec4

General

Target
(UNSAFE) WinLicense_x32_x64_v3.1.3.0_Retail_Licensed.7z
Size 226.6MB
Sample260709-lk437agy5s
SHA256 3633507531344b06079124af605f93434969748d137b37a85136e46269862ec4
MD5 61920a3a6c3371f22ab04b00aa91ccca
SHA1 5c9fdd06d96ea5a19cd4d3cb756fb78eef9def8d
SHA512 d3052b1256b16566f6c64ead30ee6b904e07c540c27076f413dcd9683eea11c72739d155b28d8fbd27a82901435dd7783df1c12275001a3a6d57cd5a7117681d
SSDEEP 6291456:ivc7ECYZLfJExuta+B/V4f3k5a76npaOv1bP3Y:ivc7KZLf8rP6a7ipNv1To
TLSH
T1A1B833F3BE1712E3BECB1DA55DD598E7E002573E220C6573F95A7066E083623A487B09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  (UNSAFE) WinLicense_x32_x64_v3.1.3.0_Retail_Licensed.7z
- Size 226.6MB
- SHA256 3633507531344b06079124af605f93434969748d137b37a85136e46269862ec4
- MD5 61920a3a6c3371f22ab04b00aa91ccca
- SHA1 5c9fdd06d96ea5a19cd4d3cb756fb78eef9def8d
- SHA512 d3052b1256b16566f6c64ead30ee6b904e07c540c27076f413dcd9683eea11c72739d155b28d8fbd27a82901435dd7783df1c12275001a3a6d57cd5a7117681d
- SSDEEP 6291456:ivc7ECYZLfJExuta+B/V4f3k5a76npaOv1bP3Y:ivc7KZLf8rP6a7ipNv1To
- TLSH
  T1A1B833F3BE1712E3BECB1DA55DD598E7E002573E220C6573F95A7066E083623A487B09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware bootkit defense_evasion discovery installer persistence ransomware spyware trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Patched UPX-packed file
  Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Enumerates processes with tasklist
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1