Extracted

• • Target
    Be sure u want to open this/Naenara.exe
  • Size 9.2MB
  • SHA256 bff8ef5dccbec8801164cf8d90b8bd80b0e7638ec25afdba0fbcc76b0fdbad82
  • MD5 020ab399f90d1d88ffb86f39bf8762b3
  • SHA1 ed62784354eb45af27b807c2bc7532d71251bb57
  • SHA512 2b3b2c5f92a43173a84120c32b568eaafcf0bc49ad81fc097e6bd39dbd8216d001dfe56ee5c40d130bd02804d04ac7616ca8d091eaf785353a387de43a3dd224
  • SSDEEP 196608:7kqch5jKq0N2asZ8BQgsmucLzh8u4GfjoBE+9hq3R4UT1yuHh8UErmvoeo4xX:7kqch5j/lyB7SGEBE+9hq3RXT1LDErm9
  • TLSH
    T16EA633DE563CFF38CD7744366AB78285C7CD98FE8580649A901816B71C2E82616ED2F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionexploitpersistencetrojanupx

  • UAC bypass

    defense_evasiontrojan

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Looks for VMWare services registry key.

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Modifies WinLogon

    persistence

  • Uses WMI to collect hardware manufacturer information

    Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

    defense_evasion

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    Be sure u want to open this/goonerware.installer.bat
  • Size 2KB
  • SHA256 bce6f68a7d83cfbe6125d72e2496921a1f29cf3cfbe21fa00ca66469b19ca07d
  • MD5 b4ed749ffd88566ebe52ef75e20a1f65
  • SHA1 0484138c52c3771a827dd037f0dd06e6040b548c
  • SHA512 31752d4dc1a06be53baa1ab301e4a6351e50bef4b48cbd5e5f78b1712b1acf6ae718672a1fd61f4e56e104be301df7ecc0fca8b2339699bd0a3ee8691f8435a1
  • TLSH
    T1B451CB3EDF79F8D0437DB0A0C8292E6731946B93C7B18F78E181196A4C68215DF2B68C
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionadwarepersistenceransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4