276a8250ec0996255ea15d4278bdcf9d6052792d1b33cca16421ab5bebadf03f

General

Target
UltraUXThemePatcher_4.5.0.exe
Size 159KB
Sample260916-3gnepswgpg
SHA256 276a8250ec0996255ea15d4278bdcf9d6052792d1b33cca16421ab5bebadf03f
MD5 dbf16781f0efb24b88d04be0b4fbd89f
SHA1 6a00b9631ee159159466e7a164f24d0af83f8a89
SHA512 4b602a87f20e0de16c4f8b6b9aa142d64228515a8514108c64861b4cbb0fe934944a4ad1aae4c608c0f42508b8ff727b3f16c0ce595d42a2bd4783930689b2d9
SSDEEP 3072:fX47fcIrwR8ksuGst/Oogm+guMZNV+D2SYkYuukLoZQxL8ue5T60tl:fX45rw6QtWoZ/RfIGuJo698ueE0j
TLSH
T123F3E11073D0C873D5A707311E779AB76EAA7D101698974B2720BB1FBC33A60DE2A752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  UltraUXThemePatcher_4.5.0.exe
- Size 159KB
- SHA256 276a8250ec0996255ea15d4278bdcf9d6052792d1b33cca16421ab5bebadf03f
- MD5 dbf16781f0efb24b88d04be0b4fbd89f
- SHA1 6a00b9631ee159159466e7a164f24d0af83f8a89
- SHA512 4b602a87f20e0de16c4f8b6b9aa142d64228515a8514108c64861b4cbb0fe934944a4ad1aae4c608c0f42508b8ff727b3f16c0ce595d42a2bd4783930689b2d9
- SSDEEP 3072:fX47fcIrwR8ksuGst/Oogm+guMZNV+D2SYkYuukLoZQxL8ue5T60tl:fX45rw6QtWoZ/RfIGuJo698ueE0j
- TLSH
  T123F3E11073D0C873D5A707311E779AB76EAA7D101698974B2720BB1FBC33A60DE2A752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery exploit ransomware
- Possible privilege escalation attempt
  exploit
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/SysRestore.dll
- Size 5KB
- SHA256 c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e
- MD5 4310bd09fc2300b106f0437b6e995330
- SHA1 c6790a68e410d4a619b9b59e7540b702a98ad661
- SHA512 49e286ccd285871db74867810c9cf243e3c1522ce7b4c0d1d01bafe72552692234cf4b4d787b900e9c041b8a2c12f193b36a6a35c64ffd5deef0e1be9958b1f7
- SSDEEP 48:S5SLAPmT5fqaB2WB2BtBAQPcPzRcCB0E3ngT2p2UlE41qSK1Gx:ASQM57LAfuQULRxB0E3gKU941LKQx
- TLSH
  T125B12277D7D089B2D182073A44C749E72666D165239045EF456BAC3A39622E7EC3C7C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsisFile.dll
- Size 5KB
- SHA256 a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
- MD5 b7d0d765c151d235165823b48554e442
- SHA1 fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
- SHA512 5d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
- SSDEEP 48:a+guelvxkcuEkVy5wM4zL5stbmaN0QpUFdAwsj1gAtl/lSFc/H9UhV0n:3CBxIEkVQwzR2300URs5ldSFcv9c
- TLSH
  T191B1D83B69A097F2E0044673177B2EC76CB2A16433C9012F4B531A207E51937EDAEB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5