Extracted

• • Target
    setup_hacknet_-_labyrinths_5.069_(15083).exe
  • Size 151.9MB
  • SHA256 27e09bd7043cede75e7de54915d40aefe08fc0ecdd018ef963dc1f635da09a02
  • MD5 344dc25a2814f9714b0a033750a7c5ce
  • SHA1 465139f997ff6218ce37380b7c743b20a231844f
  • SHA512 c822df24a5aad883f4c9f604864ab2d813286329950cd48acd3eb563fdff2e3f90edc0dab4f9ec8b1460706f17e70e1b6b1a465a5609ee60335fe885b27aff32
  • SSDEEP 3145728:RVLmj3s42hzr/PpF3wFcPCHuvuHAzaKa7Ja7GJVqfl4aqXnjCcF+KazC7JX01Ek:RNmj3A7wFcKHtgzHa7JFTe4ac+qJE
  • TLSH
    T16D78330098FA98D9F865F0F040634169EECC3E6EE7C658E68CD5F05C1A7C9915AFB90B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryinstalleradwaredefense_evasionpersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    setup_hacknet_5.069_(15083).exe
  • Size 258.7MB
  • SHA256 fd4878aa365ee905fe6b71847a39a9ef9025018fe5508fdd1123f63d0daff1e4
  • MD5 f940ba06b6a9b3e3f07846f71d0f8d09
  • SHA1 36cbd4da3168c96df1cc3fc3b549d5e2ee9f4de0
  • SHA512 5b0a4bf597109d51162807e727590fd8bc7ade390df7501025b2063ae12d95f36fdfa8863c164130243525fc0011fe9c39cf618ebb16242ab6d46c52c6c01cd0
  • SSDEEP 6291456:iquF0Tz4TDiJu+epS/bPVgtEkqtLYC22uN/oHu4QHYkGxC:huF448uNpSmtEkL2uNACHYkG
  • TLSH
    T122D83380D88B5CD8E26D32F44897E3495EED0C7EC3C8D9874AE6B44C667C92129BF54B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryinstallerransomwaredefense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral3behavioral4