37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf

General

Target
Installer-1.0.6.exe
Size 12.0MB
Sample260804-x45dvawwct
SHA256 37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf
MD5 82834a737ed33e0357711784d973255e
SHA1 f7c90d63e77ea58bad7fbebe88a451d9f6c03031
SHA512 19743f246415d57c578d15bb5f22548bb2f164f3be57e42bb7c0f8de0c0871e947554bab7384c6b3e52cf834a1db0f9143db190c58c232069e67db74fe632a6f
SSDEEP 393216:+b27r5L0PrKAdEVoALL3sAW0YmmccyTxhAN+x:+bc5L0jbdEVoALQAW9F6
TLSH
T112C6332351FA6836FAB89372B171D2818966B167372BC3FF2649C86508139DC1F36B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Installer-1.0.6.exe
- Size 12.0MB
- SHA256 37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf
- MD5 82834a737ed33e0357711784d973255e
- SHA1 f7c90d63e77ea58bad7fbebe88a451d9f6c03031
- SHA512 19743f246415d57c578d15bb5f22548bb2f164f3be57e42bb7c0f8de0c0871e947554bab7384c6b3e52cf834a1db0f9143db190c58c232069e67db74fe632a6f
- SSDEEP 393216:+b27r5L0PrKAdEVoALL3sAW0YmmccyTxhAN+x:+bc5L0jbdEVoALQAW9F6
- TLSH
  T112C6332351FA6836FAB89372B171D2818966B167372BC3FF2649C86508139DC1F36B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1