Extracted

Extracted

• • Target
    DJ Fatboy Vol.1 Track 4 Remake.mp3
  • Size 6.2MB
  • SHA256 71c1657d4913b410d2518a3339ae984e48573eb8cf801edc12654436c3b4bd59
  • MD5 93e933c5fea364528dd2ed19d4524bd7
  • SHA1 58b485dffb95aa3a545490fad56951b13f280243
  • SHA512 f852f0d504ac092d4413ad71b111a485c39f6d3e9c0bba8724c1c7538c33195d141371c46ef2dfefbec73a74d51481353c97c001abfb1a0ff85e9d5218bb1452
  • SSDEEP 196608:Zz019Jc2DsyzU8Iob4JjSgZ6S+ytKpuKBrvZA:Zz0BxUpo+h5+LuKBDi
  • TLSH
    T1F666235ABB42523FF56B56BD738B0988D49A2EABA030D1C5F522F3C536B318427E05C7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistenceprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2