6a36f60d119bf9060dc1be6d6a7e7db492802c5f76fe874e7e2288552dcfebab

General

Target
YouTrustInstallerBundle.zip
Size 27.1MB
Sample260808-l9rjdsdn2s
SHA256 6a36f60d119bf9060dc1be6d6a7e7db492802c5f76fe874e7e2288552dcfebab
MD5 d9b085c230b2fd051fd98c0a57c09300
SHA1 2d146ad691575b43ce7501e86080bb6b024b1b3a
SHA512 faad8bbb96eec6d8be9d5bbae60283ddcd4807a5d452f5edc9aa5a27843505f430a9bea32f351657155b6c0241847947aa10cca3df37e819ff147345b9018a4a
SSDEEP 786432:/UNjoT7ZnMcPOORflq7KyPigg2i5KBUfVRzuYUigczj:/UNjU7Zn7POOflwvPO5KyV5
TLSH
T166573303E04EC64CCB5B305952A9F8498BDDA866F07D5BB7E94CCF4E43BB05702EA919
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  setup/YouTrustSetup.exe
- Size 27.7MB
- SHA256 9b1a4de63f3d823892879629d12f13b886df9283309f6bfd1b3691a66b662415
- MD5 ee442f5e8a955e93a75181530650d774
- SHA1 a6ab37e09e638c410b84bd4de5d1444b011bee10
- SHA512 e8399ddf239fa2fad0b1ec039e94cd5cbf78ed020f0a34554b8a2fff2dd0df6a974b4bdf6873a4590b009196578e496720ded21ab9bd367c90791062bead5c18
- SSDEEP 786432:Yjztjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdk:Yjzdpx56Bu61eGv1pjg6pa
- TLSH
  T191573332B194803AE7F71132A539E5209E7DFE24672085AFE3C89D1E2EB148157F7726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation ransomware revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2