Extracted

• • Target
    kentware.exe
  • Size 942KB
  • SHA256 de0c35942a08fed7a7c63d895e2cbda827c29055ea6e6a0e217ac25aa6c47a8f
  • MD5 3467e86329de37e4e9b878a2fa34ac6e
  • SHA1 89db06dae61bd9f0d8099c6486297148e9f3eca2
  • SHA512 0df43ce21dfdf4ea8dc3b4e35765fc762dcaad97c96a0150cb3fd52b6a7ca3bbea68ce2aaba3c727a2e1ab055a51773a349b2f4cddd02ce6ccfe2e3c2e7af6d4
  • SSDEEP 24576:Fm3Ko/5ACvZ2ghAVeQpA2HL+3rWHmVEai1npL:Y6o/572ghAVeci3ymC1n
  • TLSH
    T1ED25BFA9F1B980ACC1AAE0F8DD52A80BFB71384403149AFB1BC969151F73BD067B7751
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionupx

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Looks for VMWare Tools registry key

    defense_evasion

  • Looks for VMWare services registry key.

    defense_evasion

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1