9834a6ed1ef94f18d4a0199a3103fe4545005d8c62ba92a29f09837702ddc69c

General

Target
setupV7.6.0.exe
Size 464.4MB
Sample260804-ay5q4adr7y
SHA256 9834a6ed1ef94f18d4a0199a3103fe4545005d8c62ba92a29f09837702ddc69c
MD5 1a7503cdb9b75b6d551e6b7ae051d0b0
SHA1 a57170355722859d0d5bfcf1f0d6b0077e29b5b8
SHA512 ee486dd3dbd35c5ced0e1f04226867f06f7b7672b886ce7d4fa3faf74175e619aa1f79bdceeee93000d26f044653f0cfe4a27e2cd59f74bb4619f1124ca0869c
SSDEEP 12582912:TQHiv6LMxeTFwIH5yE77FHJ85M8fnkgUlXjnPq/X4bZv1x/Irh2:TfsMxexwopzyn6Tn3BS2
TLSH
T19C393380D3FC4D32E0FC773342A163296286158C5A76AE7AFB77AA605B031C578F4A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setupV7.6.0.exe
- Size 464.4MB
- SHA256 9834a6ed1ef94f18d4a0199a3103fe4545005d8c62ba92a29f09837702ddc69c
- MD5 1a7503cdb9b75b6d551e6b7ae051d0b0
- SHA1 a57170355722859d0d5bfcf1f0d6b0077e29b5b8
- SHA512 ee486dd3dbd35c5ced0e1f04226867f06f7b7672b886ce7d4fa3faf74175e619aa1f79bdceeee93000d26f044653f0cfe4a27e2cd59f74bb4619f1124ca0869c
- SSDEEP 12582912:TQHiv6LMxeTFwIH5yE77FHJ85M8fnkgUlXjnPq/X4bZv1x/Irh2:TfsMxexwopzyn6Tn3BS2
- TLSH
  T19C393380D3FC4D32E0FC773342A163296286158C5A76AE7AFB77AA605B031C578F4A5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2