7e92ea630e286fad97f7ba3f1a07c4311c385f7d6ac9fc86688c9211012bd826

General

Target
AVAST.rar
Size 642.7MB
Sample260808-zz4b4avcqh
SHA256 7e92ea630e286fad97f7ba3f1a07c4311c385f7d6ac9fc86688c9211012bd826
MD5 8ff0be7d794620b6f650e6fb1eab2bb0
SHA1 945f7dbf4c40d610eae0cf40e989581a8ac8059c
SHA512 53bc94cb2990e8279a0787bc8dde3da415fee04313564e901c3ea56f83310fb6b5fb2b25dcbef7d10c644636e98a91a062f83082db852e8a4a6f455d0a770396
SSDEEP 12582912:0n7E3SiDv+LMXM7i2G/qqt1gMlBPn/f470ETR5reKfOo:0n7K18W2Gtt19PPnIIE15iKfOo
TLSH
T1F26933357A34C438E2318472C81268BBA5BC3C77D32405EF91F4AA6E27763D66BF9512
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  AVAST.rar
- Size 642.7MB
- SHA256 7e92ea630e286fad97f7ba3f1a07c4311c385f7d6ac9fc86688c9211012bd826
- MD5 8ff0be7d794620b6f650e6fb1eab2bb0
- SHA1 945f7dbf4c40d610eae0cf40e989581a8ac8059c
- SHA512 53bc94cb2990e8279a0787bc8dde3da415fee04313564e901c3ea56f83310fb6b5fb2b25dcbef7d10c644636e98a91a062f83082db852e8a4a6f455d0a770396
- SSDEEP 12582912:0n7E3SiDv+LMXM7i2G/qqt1gMlBPn/f470ETR5reKfOo:0n7K18W2Gtt19PPnIIE15iKfOo
- TLSH
  T1F26933357A34C438E2318472C81268BBA5BC3C77D32405EF91F4AA6E27763D66BF9512
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan
- Suspicious use of NtCreateProcessExOtherParentProcess
- Renames multiple (55) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1