Extracted

Extracted

• • Target
    Internet Download Manager 6.43 Build 9 Multilingual + Retail [FileCR].zip
  • Size 23.8MB
  • SHA256 3aa21ad0c17d2611cb02a52f23a69517d285ce882c596f2731f08c0e5562fe51
  • MD5 fa0ce5721d3a67ded436046101443278
  • SHA1 d98268de533e6a47c48cec4d1cb6e7b867c52188
  • SHA512 e09f71cbe84f766c3b7909833fa3652b2eeea2a68498a8ecfec4d6e186082b6b80d389846013340064be877178bbca1f24f4b8fa531e01b271c4e7dea1f7b74d
  • SSDEEP 393216:7QebJc1DqNThmT9MYgZrqgX9U21KRZoS0EML1NOIuvu3ANo96LCoR:UkWDqy7gQUV18oSdQ5uG3AzN
  • TLSH
    T19C4733E49359EBC918B7AE1244DA57A0257D92FF94F6F8C206210FF5107EBC2837364A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionpersistencephishingprivilege_escalationspywarestealertrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables cmd.exe use via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops Chrome extension

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1