Extracted

• • Target
    VBCable_CD_PackSetup1.exe
  • Size 7.6MB
  • SHA256 4ec6ee276e67db88428dd49de6ddcafd7df918b9d2e5866eda24a684f0de4419
  • MD5 109dc618c5883f1ef8a3f823cdf12cf7
  • SHA1 695754f5c3d9915557096b38d0095af9a5c28c2d
  • SHA512 089e75a957e98fe92d973e5e68bde88e385aea06f117082535c241ef41bd5c9c62c28e4d28a18ae7bb470213ca33060a7f2e0f4f8a294d1555d03defd15f731d
  • SSDEEP 196608:a4OUA9d5UoSgCK9pSw5aJpmgJMiP8Su8322w8NQtjfeH:avpP5qgCisw5ypmgJMiPTG2wBt
  • TLSH
    T1C986CC7707DB5F17EABFDA919880543B193C09AC9418DD2F2E41D928005A82C7F6B9BF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1