c1c7c5d3eaf119905dd0c57cc4b67418a07a1bc8fd156429aff5e92a254ee5f2

General

Target
DLL Injector_2.3.1_x86_en-US.msi
Size 3.7MB
Sample260809-19wwfazwas
SHA256 c1c7c5d3eaf119905dd0c57cc4b67418a07a1bc8fd156429aff5e92a254ee5f2
MD5 99cf162aeb2b0b2e5eb27f72225e4e09
SHA1 32e67ca33444cdc419d7352f051c590785bdb509
SHA512 bf7dfb30722a354142890d9c24a1c962948510fc91bd7de6251266a7998b9a44bcd71fcbe5cabe6a1dac883d47d6f7f5693dae05e558de77064cc3580fba3bea
SSDEEP 98304:uEuXMORE4WTDn2b1tTtXsrV8rwt4de1GJg8CldZ3eUm:uBq4qgnrGOeWKO
TLSH
T17B06334BBE868A22C4170D734836A7651A7DBC604F119A9373DD377CDCF22C09E66AE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DLL Injector_2.3.1_x86_en-US.msi
- Size 3.7MB
- SHA256 c1c7c5d3eaf119905dd0c57cc4b67418a07a1bc8fd156429aff5e92a254ee5f2
- MD5 99cf162aeb2b0b2e5eb27f72225e4e09
- SHA1 32e67ca33444cdc419d7352f051c590785bdb509
- SHA512 bf7dfb30722a354142890d9c24a1c962948510fc91bd7de6251266a7998b9a44bcd71fcbe5cabe6a1dac883d47d6f7f5693dae05e558de77064cc3580fba3bea
- SSDEEP 98304:uEuXMORE4WTDn2b1tTtXsrV8rwt4de1GJg8CldZ3eUm:uBq4qgnrGOeWKO
- TLSH
  T17B06334BBE868A22C4170D734836A7651A7DBC604F119A9373DD377CDCF22C09E66AE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery ransomware trojan adware persistence privilege_escalation spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2