dd4a8c3d4afbe1cc1bd6d76bb20c5049ab48c107fee434232a6cc30bd96204c8

General

Target
250206-1yfp3sylcv_pw_infected.zip
Size 3.0MB
Sample260810-yee84agk2w
SHA256 dd4a8c3d4afbe1cc1bd6d76bb20c5049ab48c107fee434232a6cc30bd96204c8
MD5 0d16179b144f934f18f06dd92855305f
SHA1 0ae2b8f5408854fc231f97f154af0d00d3cfc744
SHA512 f8df0e90951aaca65adc25d300e5d3681a1d7304f56b046e9f2f95cf1fc51ccd2565829b62063e399431f150160957e9a938d89f996854a568a89f2dff46bef4
SSDEEP 98304:+XkPzR9L1tv++m1B29WH91O4Y/VnEDcldH:+m+Ry9x4Y/scH
TLSH
T1A5E533D777B00D62D9DB909E35C8B6ABDB790C085750E766C78DBD0C028499FABDB802
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  WinGas.exe
- Size 3.1MB
- SHA256 138fbad4bdec2f62d7c0e60e4317023b5b6c0009371885b0b14090b1ce2c339f
- MD5 4f09173484799fef0ea81bccd8c52a4a
- SHA1 77d4f240cd66e94222ee5d7ede2234920705e4e3
- SHA512 80213cadf95ce2ade75ae1c7ffa5ab664dc6269dd9671a4b8c32b3f6f6614057f82ead27e1df1634cd4015e4931fbfbb32a33a8dfdcf13f4078cb4d640ad7ef4
- SSDEEP 98304:fwY/ehNdz962NiCvbA2nwRXjsKkXm2iSexj5b:fwwehNRYWbnKk22Jo9
- TLSH
  T1B4E533C9CF91107BF27344B1C0E372754F466605A39A9AD3832E2D269763E508AF9C7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan
- UAC bypass
  defense_evasion trojan
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Hijack Execution Flow: Executable Installer File Permissions Weakness
  Possible Turn off User Account Control's privilege elevation for standard users.
  defense_evasion persistence privilege_escalation
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1