c1ecffc65a8e9c43c544fce6fe6ef98699766578a7930e2f50c3db8b16a9b053

General

Target
卍 ALL 771 VIRUS 卍.rar
Size 115.9MB
Sample261111-qw96sshg83
SHA256 c1ecffc65a8e9c43c544fce6fe6ef98699766578a7930e2f50c3db8b16a9b053
MD5 466fe9d05321ef1b001ce14d998d7334
SHA1 ce30ae5271145e73fa59613b549724e33fa58503
SHA512 58b4f33ba25ab7b58132a846874f04750f4e951351b2a62c8bb2ab64add394f37f6639f7d5630f7029f653b398fc114471fb8e6e514ba43277a48012c0b207dd
SSDEEP 3145728:kC8tSC8FwyvqOf0Rh66uYY0uOVCT8g+4+strh60zcRk:Z8tSX0DRY0uOVCTj+strh60zV
TLSH
T1754833DE8EB09B4E2CE9B5E7F4918CF1965E1367B0B14EEDC52814C0D9AE3319274AD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  卍 ALL VIRUS 卍/virus.exe
- Size 26.7MB
- SHA256 68a3adb1c4f8d1b9849f56e05403f51d2fc1ec813e83b82099cc35c8104d5c0a
- MD5 c1e188e3bd87d5625d5e1639bff76f22
- SHA1 b4c327889b57562e1c609f3c5fc1c1451e8cb8ab
- SHA512 b31c51e8df25a1b38b1f60e787b5ce12535972663c941651f5f3eceeed1a5eb6cfa722453a6c2d2d0f29717bcada8911d0906a4f4608037c1e3426d23aa11ea9
- SSDEEP 786432:WbS4ce2s7XARphqrhsqP6bxW2m310MrbjSvsr3Shw:t4f/sPhqrfP6mF0i3Shw
- TLSH
  T1EC573315BA9510FFE4FBD23DAC9EC45263F375465396C2AF17180BA41EA72D02E38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit persistence privilege_escalation pyinstaller ransomware trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1