8146db4d3a87201fb80ad1d3712ba8f56883e9a0811758bd39f62d73a9f2c586

General

Target
ep_uninstall.exe
Size 11.7MB
Sample260903-t4nvbaad94
SHA256 8146db4d3a87201fb80ad1d3712ba8f56883e9a0811758bd39f62d73a9f2c586
MD5 a611f07c3b935ef80361cb326a6c659d
SHA1 660c5bb132cd03822b2982ad53cd1d1aee801a13
SHA512 e8c21dc4a746c50cf14fdead54a37d8d77b40ae6276118bb2797039ca9b741dc519521c3264283b4e31dc2af9448f6c0a60bf25fc7b4a40ba5d9b7f309074a07
SSDEEP 196608:LAvKGmJYCEKfMhjfGptv0jikRUEiyi5o2ItCC2bO+WxNtTYne/C5YbM1Vd+2AB5V:EKXOCEti4jikiEZijTCIKNtUnwYYA1K
TLSH
T118C633257BE209CEFA3BC37898B3110691A97D076B35D8BF9650059E4D33BE2C538729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ep_uninstall.exe
- Size 11.7MB
- SHA256 8146db4d3a87201fb80ad1d3712ba8f56883e9a0811758bd39f62d73a9f2c586
- MD5 a611f07c3b935ef80361cb326a6c659d
- SHA1 660c5bb132cd03822b2982ad53cd1d1aee801a13
- SHA512 e8c21dc4a746c50cf14fdead54a37d8d77b40ae6276118bb2797039ca9b741dc519521c3264283b4e31dc2af9448f6c0a60bf25fc7b4a40ba5d9b7f309074a07
- SSDEEP 196608:LAvKGmJYCEKfMhjfGptv0jikRUEiyi5o2ItCC2bO+WxNtTYne/C5YbM1Vd+2AB5V:EKXOCEti4jikiEZijTCIKNtUnwYYA1K
- TLSH
  T118C633257BE209CEFA3BC37898B3110691A97D076B35D8BF9650059E4D33BE2C538729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution exploit installer persistence privilege_escalation ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Possible privilege escalation attempt
  exploit
- Creates new service(s)
  persistence execution
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1