081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e

General

Target
081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e
Size 1.3MB
Sample260903-lzcmgseq51
SHA256 081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e
MD5 6c66dcde2170aeab57b9ddfd5a68b0c2
SHA1 f3317710fd3f380655bf3080246393dac68f0765
SHA512 e1822e62b1be9e6bdc85d7ea9a2620d93122a51c50ff685dde9bb6cbe008c17b091d2d636b72a0b319e2b9b022750c52342ac875c1dd98a41f2f9aadb11a6570
SSDEEP 24576:v7M/vXd0GFi/eytAEuJ7qxu3qJ9ps1Rg8ZwyBKfPuAhYt2iH/6w2pZPvpf7Qg6aE:v7Kfd0GFi/pAEE74fe1R3JgfLhYtvCRY
TLSH
T1625501213792C077D7E300318A82C7A8627B7ED169EF9D07BBD07E4DDA3015EAA35A51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e
- Size 1.3MB
- SHA256 081c2149d2e25f105805b921c2f3cf68a5f376bf86c32dd44f19d79c3fa3c66e
- MD5 6c66dcde2170aeab57b9ddfd5a68b0c2
- SHA1 f3317710fd3f380655bf3080246393dac68f0765
- SHA512 e1822e62b1be9e6bdc85d7ea9a2620d93122a51c50ff685dde9bb6cbe008c17b091d2d636b72a0b319e2b9b022750c52342ac875c1dd98a41f2f9aadb11a6570
- SSDEEP 24576:v7M/vXd0GFi/eytAEuJ7qxu3qJ9ps1Rg8ZwyBKfPuAhYt2iH/6w2pZPvpf7Qg6aE:v7Kfd0GFi/pAEE74fe1R3JgfLhYtvCRY
- TLSH
  T1625501213792C077D7E300318A82C7A8627B7ED169EF9D07BBD07E4DDA3015EAA35A51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware bootkit defense_evasion discovery execution persistence privilege_escalation spyware trojan
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2