2dee39baf8c26939d9bcd8c44140eb676566ce5221609653815ed3d80c92a10d

General

Target
Penguin.png
Size 13KB
Sample260907-dwezfaee44
SHA256 2dee39baf8c26939d9bcd8c44140eb676566ce5221609653815ed3d80c92a10d
MD5 ac597fafe22a856f92a6842e40a251b9
SHA1 ec65bb43a2cecd18cce010195567307ce34c9262
SHA512 811f21d44bcd6611ce3ebbb4ab8ef82eca066fae538fa4df2708f0dd1a36b65e78b6f244f32738ff1ce094beae17dc6414f80433ce6a2577716de694d44e8966
SSDEEP 384:aFDZLrCu9lDvadn+1pP5NTfB4i85HKq5R6aC:atZLrzcWNTtvqLHC
TLSH
T17C524A0B9E48D7D3989897FC7C434CB86A4F6B08A49A7BEF90310DCF6E502651DCA45E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Penguin.png
- Size 13KB
- SHA256 2dee39baf8c26939d9bcd8c44140eb676566ce5221609653815ed3d80c92a10d
- MD5 ac597fafe22a856f92a6842e40a251b9
- SHA1 ec65bb43a2cecd18cce010195567307ce34c9262
- SHA512 811f21d44bcd6611ce3ebbb4ab8ef82eca066fae538fa4df2708f0dd1a36b65e78b6f244f32738ff1ce094beae17dc6414f80433ce6a2577716de694d44e8966
- SSDEEP 384:aFDZLrCu9lDvadn+1pP5NTfB4i85HKq5R6aC:atZLrzcWNTtvqLHC
- TLSH
  T17C524A0B9E48D7D3989897FC7C434CB86A4F6B08A49A7BEF90310DCF6E502651DCA45E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution installer motw persistence phishing privilege_escalation spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Suspicious clipboard content.
  A suspicious script was copied to clipboard.
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1