08b82e2125b63ec97ed8fb9cbf829ca31935b8dfa2f67be4d686353570554281

General

Target

0v3yT8.06.10.exe
Size

2.4MB
Sample

221121-antabafb8z
MD5

3fcf77ffa0763350a1df45ab3b89f26a
SHA1

0431c506fb86f1813621bc0d09ba12389021cc6b
SHA256

08b82e2125b63ec97ed8fb9cbf829ca31935b8dfa2f67be4d686353570554281
SHA512

07568d02a3cddf5285cf3ea7ab4bc05fb3cc0739b4bd59c75bdf60f0950a52e4ecc2168f53d5f41031271716ecc8babd164e42007c1cdf9ba00e55124232b842
SSDEEP

49152:wgwREifu1DBgutBPNbPz0F3SMzx5QPdqGbHpIAxKof9X7PID/n3ZkIe:wgwREvguPPxzsfTe8GbHjkofeD/n2z

Score

10^/10

Malware Config

Targets

- Target
  
  0v3yT8.06.10.exe
- Size
  
  2.4MB
- MD5
  
  3fcf77ffa0763350a1df45ab3b89f26a
- SHA1
  
  0431c506fb86f1813621bc0d09ba12389021cc6b
- SHA256
  
  08b82e2125b63ec97ed8fb9cbf829ca31935b8dfa2f67be4d686353570554281
- SHA512
  
  07568d02a3cddf5285cf3ea7ab4bc05fb3cc0739b4bd59c75bdf60f0950a52e4ecc2168f53d5f41031271716ecc8babd164e42007c1cdf9ba00e55124232b842
- SSDEEP
  
  49152:wgwREifu1DBgutBPNbPz0F3SMzx5QPdqGbHpIAxKof9X7PID/n3ZkIe:wgwREvguPPxzsfTe8GbHjkofeD/n2z
Score

10^/10

evasion persistence ransomware trojan
- Modifies security service
  evasion
- Modifies system executable filetype association
  persistence
- UAC bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2