fcc5efccc525da365f22a3a8b9dec071c9ece811fc64d928bb2fa1e704e77c27

General

Target
ssdsadsadsadas.exe
Size 1007KB
Sample260718-dcdl9sdy7l
SHA256 fcc5efccc525da365f22a3a8b9dec071c9ece811fc64d928bb2fa1e704e77c27
MD5 2f640c998286ea6d16b8477a5214d26b
SHA1 06015213ba273f4a6cd7fabbb0c57b549c61eeb5
SHA512 399d465cdea42ad2b0362c9502061d07223a6a3dbea50d0ab5f170ba73007cb16a41add253718158a997aac2648d85d1b3c74f7da3eeccbc94e6b3b420452866
SSDEEP 12288:VPOZZSM84fwiByxhDavd09JJtfJNnjwVyBotdWg2qJLvYbCAnWBYYMK/sw/wciUB:sGaAF9BA+YTi37
TLSH
T1AA25162439FB501EB0B3BE929FDCF9AACD6AF636150E35B6204103478B13D81DD52A76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ssdsadsadsadas.exe
- Size 1007KB
- SHA256 fcc5efccc525da365f22a3a8b9dec071c9ece811fc64d928bb2fa1e704e77c27
- MD5 2f640c998286ea6d16b8477a5214d26b
- SHA1 06015213ba273f4a6cd7fabbb0c57b549c61eeb5
- SHA512 399d465cdea42ad2b0362c9502061d07223a6a3dbea50d0ab5f170ba73007cb16a41add253718158a997aac2648d85d1b3c74f7da3eeccbc94e6b3b420452866
- SSDEEP 12288:VPOZZSM84fwiByxhDavd09JJtfJNnjwVyBotdWg2qJLvYbCAnWBYYMK/sw/wciUB:sGaAF9BA+YTi37
- TLSH
  T1AA25162439FB501EB0B3BE929FDCF9AACD6AF636150E35B6204103478B13D81DD52A76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware collection credential_access defense_evasion discovery execution exploit persistence privilege_escalation ransomware spyware stealer
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Possible privilege escalation attempt
  exploit
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1