1fc8dca765dec7cf55571d81bc9fc442d53dc381c7474394b928379f36f87993

General

Target
UltraUXThemePatcher_4.6.1.exe
Size 159KB
Sample261025-rc5yeahw8l
SHA256 1fc8dca765dec7cf55571d81bc9fc442d53dc381c7474394b928379f36f87993
MD5 172adb60f002c690b375bb33e2d5d9c2
SHA1 06e6b3df679999534bafbfa14caae42092a87446
SHA512 533b1b8e7f0e156aa63c9c907b6047237cd36d5401215755fa0b1b570e827e5e3e06630bb96b260d08ddd834d40bd2cba8ebfed00149f7ccfdefe6dc8ef6318d
SSDEEP 3072:ElnffjVrwUak7uJsti3wyQFehGn1li4e9Uo3Yy6MU9n7/Y4FhcIuW:ElnhrwtStOwMonT5hol6p584FhcIn
TLSH
T171F3E00473E0C937D5B707326E379BB15E6AB8301691170F7740AA6E7C33641ED2ABA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  UltraUXThemePatcher_4.6.1.exe
- Size 159KB
- SHA256 1fc8dca765dec7cf55571d81bc9fc442d53dc381c7474394b928379f36f87993
- MD5 172adb60f002c690b375bb33e2d5d9c2
- SHA1 06e6b3df679999534bafbfa14caae42092a87446
- SHA512 533b1b8e7f0e156aa63c9c907b6047237cd36d5401215755fa0b1b570e827e5e3e06630bb96b260d08ddd834d40bd2cba8ebfed00149f7ccfdefe6dc8ef6318d
- SSDEEP 3072:ElnffjVrwUak7uJsti3wyQFehGn1li4e9Uo3Yy6MU9n7/Y4FhcIuW:ElnhrwtStOwMonT5hol6p584FhcIn
- TLSH
  T171F3E00473E0C937D5B707326E379BB15E6AB8301691170F7740AA6E7C33641ED2ABA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery exploit ransomware
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/SysRestore.dll
- Size 5KB
- SHA256 c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e
- MD5 4310bd09fc2300b106f0437b6e995330
- SHA1 c6790a68e410d4a619b9b59e7540b702a98ad661
- SHA512 49e286ccd285871db74867810c9cf243e3c1522ce7b4c0d1d01bafe72552692234cf4b4d787b900e9c041b8a2c12f193b36a6a35c64ffd5deef0e1be9958b1f7
- SSDEEP 48:S5SLAPmT5fqaB2WB2BtBAQPcPzRcCB0E3ngT2p2UlE41qSK1Gx:ASQM57LAfuQULRxB0E3gKU941LKQx
- TLSH
  T125B12277D7D089B2D182073A44C749E72666D165239045EF456BAC3A39622E7EC3C7C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 201KB
- SHA256 aea40659bdb08337064640ea8b4f171881d37456b37b3e2899349ac04f0889c5
- MD5 5f728e4e6b970db76c64be8ca3cafc87
- SHA1 b7481efd9f6938903214451d792a8b13a645c922
- SHA512 2cc4e870290f8faddc8eca1a03a1efb34711b3951e263a79f259fd998a9a1f957dbf58c110c5fe64febd414ec7a22e125353f9d5c363866bd0d4298452fdadc8
- SSDEEP 768:/ou/hmB0wVZLLsg0fjA9hmgr+IYesuqftVraywBZM6mJRmYUt+Bmm:AUh8xVJHnaomftVraywfrmJRnUamm
- TLSH
  T18A146C591B3104EA54595E4AB8333A7A1BBB8CF90BB6028E35EFF1353A7B7634C07605
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/nsisFile.dll
- Size 5KB
- SHA256 a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
- MD5 b7d0d765c151d235165823b48554e442
- SHA1 fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
- SHA512 5d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
- SSDEEP 48:a+guelvxkcuEkVy5wM4zL5stbmaN0QpUFdAwsj1gAtl/lSFc/H9UhV0n:3CBxIEkVQwzR2300URs5ldSFcv9c
- TLSH
  T191B1D83B69A097F2E0044673177B2EC76CB2A16433C9012F4B531A207E51937EDAEB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $TEMP/image.bmp
- Size 29KB
- SHA256 ebbe6a400cab4901c942338b9387939721921d571f3ee1c6a236a001bffae022
- MD5 f5c857165c1ab170316b905666d7cc08
- SHA1 e56b59d1fec84ff4a3600fc125b06172fbad5d95
- SHA512 a744324831d951c628d3c67332c98a7a641bdb1a5e4ea953bcb030212a36e5f70159be4313d045bd0d50a642bd2027c871225589aa7cb3b32989d1375eb6ad4e
- SSDEEP 192:ZGyfUH/UIvqQ3v6cmy+Z/X2WbnRhlndHEs:1m/zSQ3v6by+Z/mWbHldHEs
- TLSH
  T1BDD25F4A77C8121582CFAEF519787E4BC2327D6D653B6E12807AF44036B533E3B264E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7