023fcd76eab7da5000ad73e1ea0481a979be735621d5380e4dc95a4ddb2a9dcd

General

Target
! AdobeAfterEffects26AllTrial_maxon.zip
Size 497.1MB
Sample260810-jm4jbsyth1
SHA256 023fcd76eab7da5000ad73e1ea0481a979be735621d5380e4dc95a4ddb2a9dcd
MD5 2ccc88aa082d881f3ff874b3d3b98b0c
SHA1 d491e5805b8e96498d4ca233eb78efdda380bafc
SHA512 f2bf771c41ca97573576cd15165f4b53f82dbe424e616334ff3692b1228d97234e6b556a66c33573861fbcb5ed43f3d615c230045b9ebb572afbe3e7af365ee5
SSDEEP 12582912:ef8Vym305HVf4EacgkW6+Xh/q8Z4WYXhv4ARqBS:hkB1xVuhy8Z4TxlRSS
TLSH
T1144933B73B26D6191A87A3652940C1F998F38661C67E42FF4E65FEEF085927F4C080B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2/support/keyfiles/CustomHook/win/Cinema 4D Installer.exe
- Size 487.8MB
- SHA256 b79371b525bb9633b8c0f930746b9f8d916190eeb9d1fe93ce37b79dbedbc313
- MD5 d5af479efa0e0e78bb5dd1457398f75c
- SHA1 fb5138b9877a815d59645d57df3db353f192af40
- SHA512 edc262333c36c8bf12b2107d327a1cdf1453862347058e12fdebe1f488b489e8b73dc8bfd87910377f678eca7d91805568c1d9d0599681d377e5ea6ddc20e96d
- SSDEEP 12582912:h1SlUIBgtvnzjEUqQqi2ALvj02taugVzpIg9sBY:iyxz6zSvI2tat1z9aY
- TLSH
  T1B2393327F75310ACC66BC330479292B2BC72FC2441397BFE1A64EB352E65DA15B0E169
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  2/support/keyfiles/CustomHook/win/Cinema 4D.exe
- Size 11.0MB
- SHA256 5da7c2b840e86b8e991d06291abaf7a164e9ae0b8ceaf27b1a9ea5c08e5a05eb
- MD5 4722b314ba21f9753deb89e1457217c6
- SHA1 04db542c44dc2016150a46ee47d0d09af78edcaa
- SHA512 5f962549c1a97b3b748395bef6b38b7416df501905a5487298a4793a7ba62482a5b08857921f522080d093bc20616646da053a976625014541a1343b108e3f8c
- SSDEEP 196608:cTEf9mYgDn7D9+gyczO/nF/ZQDD4rM/FeEn0YduDMTxhs0FSPkGzEn3q:cTQc5Dnf9+q4F/ZQDUQ/oEwMSPkG83q
- TLSH
  T177C633AA337455FBE4925674C431E548D773B2896701F28F80318BF2EF17A989E35BA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  2/support/keyfiles/CustomHook/win/RunOnce.cmd
- Size 178B
- SHA256 535f061c08f1fe7178dcd170e4adbfd8fa29c33e353e490770bbe17ca13f8d1b
- MD5 a7ec4925c52acc8fdf9641c74183d9d8
- SHA1 73beb6b6484b3252a324aa967e91275d5b79a2fc
- SHA512 17d819700ea76adaae001639dcddd5cdf88a34c44128d46a866ce959a03555aa096acc321232de4dcd0bf42c73af30b13cbfc8ae3e62ebe061cde6c5af665661
- TLSH
  T18BC0EADA723B896C831ABC9055CA0EA76D375CB363048716A405045DD237A1D4F6B5F1
- MD5 SHA1 SHA512 TLSH
Score

4^/10

execution
behavioral5 behavioral6