2f37dfcda358f501cdbb57409b27e30db48ba9cba7bbbeab5e3b0c16c8e95c76

General

Target
DriverPack-17-Online.exe
Size 8.4MB
Sample261029-232nsagy7j
SHA256 2f37dfcda358f501cdbb57409b27e30db48ba9cba7bbbeab5e3b0c16c8e95c76
MD5 3ec45e03d75df316a482bb306a2973c0
SHA1 0ff81eac72483ecfefabf3a0a95ee65629050bae
SHA512 736115f750720669ec62b1097fa91212df1be2f73800cad92c785d5f444ac5391c42a23e0808b6195af21705b8239617987f1f3728b5d07f2cd6f4de74f74106
SSDEEP 196608:Y2z6qTHIkSyYNhem7h5MQ/j+lA3M0IFa/TvyOPf5yrXdzGew:Yw6SIBQmt5MQ/5c0HmOPfyNXw
TLSH
T106963348D2DDF812C0C5D1F1E69BD28B4736F7242B2B5FD34E4AA896E53830EC50D5AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DriverPack-17-Online.exe
- Size 8.4MB
- SHA256 2f37dfcda358f501cdbb57409b27e30db48ba9cba7bbbeab5e3b0c16c8e95c76
- MD5 3ec45e03d75df316a482bb306a2973c0
- SHA1 0ff81eac72483ecfefabf3a0a95ee65629050bae
- SHA512 736115f750720669ec62b1097fa91212df1be2f73800cad92c785d5f444ac5391c42a23e0808b6195af21705b8239617987f1f3728b5d07f2cd6f4de74f74106
- SSDEEP 196608:Y2z6qTHIkSyYNhem7h5MQ/j+lA3M0IFa/TvyOPf5yrXdzGew:Yw6SIBQmt5MQ/5c0HmOPfyNXw
- TLSH
  T106963348D2DDF812C0C5D1F1E69BD28B4736F7242B2B5FD34E4AA896E53830EC50D5AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  run.hta
- Size 2KB
- SHA256 02bd627d6825599ed039f053fecbe7f15000b5d5071e9b6baab488befa4f02dd
- MD5 6bcab16cd99663b1093d10f827ca0323
- SHA1 47b2d7f33da12d88095379fc8ea5bb7114ce75e9
- SHA512 67c23c1f3e8023001336ff7fc9c9052220f2ab67df280ef269b0239d67dfc67e6783dda44dec747ba6689c239d7efdb55262d098868e43ab70a055429349210e
- TLSH
  T19F5160A44CAF6485E02BA0A35BFB36282263816B9544ECCD3ACCA158FF90705C8677F5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral2
- Target
  start.bat
- Size 90B
- SHA256 88ebe6fc9f45e734243dd674a3cdd9222be692bde089d0bc06726dd32156b892
- MD5 f66f13d4770eb90e6d81222fe3525a3f
- SHA1 f21bc06a179c108d13c783600b98ea0641076127
- SHA512 3f321a339dee086f474d5ac9e8b247805d070b6c0ab5f9d85c5f1075021a3eb7ae23ab2b577000adc30ad32e66a1e291993f435f8539bb0032a1aca038e1f1b2
- TLSH
  T1AFB012304C3404417012DC18100721551B0C61EFA800154C20E23025C89FE49095E8F4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware upx
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Modifies Windows Firewall
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3