0cffbd0a9a71d6dc4ccb63dbbfeef735b2c8bf9acdf1409f1cbdeed36ce0faf8

General

Target
windows11-setup_11_59931.exe
Size 34.1MB
Sample220423-2fc2xaahgp
SHA256 0cffbd0a9a71d6dc4ccb63dbbfeef735b2c8bf9acdf1409f1cbdeed36ce0faf8
MD5 9b1c764f5da1e5b8963831b10b0d55e1
SHA1 921e7361981d66a38718f9e61da7ed256eb82594
SHA512 ac9acb3011200621b6ed25d10f22998d54a10b5fa0bf506bf8c6150f1aafbf8dd1563cd496e57f0307350490f09c7e970e27684ae1cc1165b78a5daf04525fea
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  windows11-setup_11_59931.exe
- Size 34.1MB
- SHA256 0cffbd0a9a71d6dc4ccb63dbbfeef735b2c8bf9acdf1409f1cbdeed36ce0faf8
- MD5 9b1c764f5da1e5b8963831b10b0d55e1
- SHA1 921e7361981d66a38718f9e61da7ed256eb82594
- SHA512 ac9acb3011200621b6ed25d10f22998d54a10b5fa0bf506bf8c6150f1aafbf8dd1563cd496e57f0307350490f09c7e970e27684ae1cc1165b78a5daf04525fea
- MD5 SHA1 SHA512
Score

10^/10

discovery evasion ransomware spyware stealer trojan
- Modifies Windows Defender notification settings
  evasion trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Disables use of System Restore points
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2