d2205532e27cf8ae9dbc0a62fdf3fca598f5fa8f9cc948bec49df54b0b8a8cd6

General

Target
windows11-setup_11_24468.exe
Size 34.3MB
Sample220423-m4jf9sgbdq
SHA256 d2205532e27cf8ae9dbc0a62fdf3fca598f5fa8f9cc948bec49df54b0b8a8cd6
MD5 f6065f381e166decd4772c0e1eda4173
SHA1 18aa4c449cd470a9ec47f560ccad9e47cd62bb59
SHA512 e357ba68bf6fa93eae2a535cd65dc887df2b05cd75ac275f42ad4d3ebc079b800438f46f774677a1373664c31929f0ec69118a15eeab9bef60c6a4fd32329500
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  windows11-setup_11_24468.exe
- Size 34.3MB
- SHA256 d2205532e27cf8ae9dbc0a62fdf3fca598f5fa8f9cc948bec49df54b0b8a8cd6
- MD5 f6065f381e166decd4772c0e1eda4173
- SHA1 18aa4c449cd470a9ec47f560ccad9e47cd62bb59
- SHA512 e357ba68bf6fa93eae2a535cd65dc887df2b05cd75ac275f42ad4d3ebc079b800438f46f774677a1373664c31929f0ec69118a15eeab9bef60c6a4fd32329500
- MD5 SHA1 SHA512
Score

10^/10

discovery evasion ransomware spyware stealer trojan
- Modifies Windows Defender notification settings
  evasion trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Disables use of System Restore points
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2