268418ddbe7e3c9532364766ba4d8415dab38deb160c36d57992f79090635381

General

Target
nq5s9wl7gvzdpg3b.exe
Size 518KB
Sample260827-ta2jbaab98
SHA256 268418ddbe7e3c9532364766ba4d8415dab38deb160c36d57992f79090635381
MD5 46a12854533cfb943f1fb395f02720f5
SHA1 955c77231542ccd92b178aae203b52b395598b75
SHA512 54e06221ba563cf74bb793d4969d77ae9e1796b9a1bd657d941b5b6461217223c729ac6bb07e354851d3e6e5e8b4fe43bb95faccc9ed8c55092deb2266659c2d
SSDEEP 6144:Ujxa9bL0I1tcdp0FU2/AgDiOR3DQGswjWe2or8c+7DTGtjsjBZc5ccPIyV0b6F/Q:uM0E3FUK+kAG4WNzFZU+m
TLSH
T152B408247FA98A18D580293E455E1614D7AAD1F226327303370AFF624D05DDEEE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  nq5s9wl7gvzdpg3b.exe
- Size 518KB
- SHA256 268418ddbe7e3c9532364766ba4d8415dab38deb160c36d57992f79090635381
- MD5 46a12854533cfb943f1fb395f02720f5
- SHA1 955c77231542ccd92b178aae203b52b395598b75
- SHA512 54e06221ba563cf74bb793d4969d77ae9e1796b9a1bd657d941b5b6461217223c729ac6bb07e354851d3e6e5e8b4fe43bb95faccc9ed8c55092deb2266659c2d
- SSDEEP 6144:Ujxa9bL0I1tcdp0FU2/AgDiOR3DQGswjWe2or8c+7DTGtjsjBZc5ccPIyV0b6F/Q:uM0E3FUK+kAG4WNzFZU+m
- TLSH
  T152B408247FA98A18D580293E455E1614D7AAD1F226327303370AFF624D05DDEEE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery execution persistence privilege_escalation pyinstaller ransomware trojan upx
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1