508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f

General

Target
508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f
Size 1.2MB
Sample261111-l4deksgs5x
SHA256 508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f
MD5 ab827150c9767113378ad2ef0d30affc
SHA1 dc3ff19a053e0e8e9c9cb03abfb5b697782b2d2a
SHA512 5eb31bd5b898913936290c7fc123cb860fa98247a03d012632112163e9bfa222d3c765e69fca57063f850137093be36d85262563d9236bb4338b1a06a746b5c1
SSDEEP 24576:nJqtaMZ0VF+emse0DiIPhuKfgc5iQK+5RXhhNmZwb28upV3nH:nQ8MZ0Te03Pjgc5xN/hNmZC28EH
TLSH
T15C55F125FA9589FCC05AC0B4825B8A735A7274CE0B3169FF12D442383F699F66F3C618
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f
- Size 1.2MB
- SHA256 508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f
- MD5 ab827150c9767113378ad2ef0d30affc
- SHA1 dc3ff19a053e0e8e9c9cb03abfb5b697782b2d2a
- SHA512 5eb31bd5b898913936290c7fc123cb860fa98247a03d012632112163e9bfa222d3c765e69fca57063f850137093be36d85262563d9236bb4338b1a06a746b5c1
- SSDEEP 24576:nJqtaMZ0VF+emse0DiIPhuKfgc5iQK+5RXhhNmZwb28upV3nH:nQ8MZ0Te03Pjgc5xN/hNmZC28EH
- TLSH
  T15C55F125FA9589FCC05AC0B4825B8A735A7274CE0B3169FF12D442383F699F66F3C618
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- Turns off Windows Defender SpyNet reporting
  defense_evasion
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2