b7f7eee0e3505fb146643a06c77edc15bc4f0d68efde56cf9c8534c4dc3dcfa6

General

Target
b7f7eee0e3505fb146643a06c77edc15bc4f0d68efde56cf9c8534c4dc3dcfa6
Size 9.8MB
Sample260714-repdfaes7n
SHA256 b7f7eee0e3505fb146643a06c77edc15bc4f0d68efde56cf9c8534c4dc3dcfa6
MD5 8636f13c7ee7468e32c90338e9a794ec
SHA1 f084a5f183623864f7081903c52df7b5a2824f67
SHA512 e43ad0976fdebcebf75a5f902bb3c5e9632706fbea088c5c24784a77965a148d65710dfc0063817f408ad9eb2e29e88945bcc3e7f3c208ec3f9f0a56a29bbba7
SSDEEP 196608:iz6XT9WoKve1fjQqbnBm9Oq2GVRKQEHgIGjyf4DA1M6rWfj+uIJA6J0SyC:/9NK2dQqbBd6MAILf4DKJrlCpSyC
TLSH
T128A6333BB3D4A081B427016BE57E26952C3BB169B795FC21EEC3327C4488E9F31B4656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.66tt009.msi
- Size 9.9MB
- SHA256 d132d88d85641503b7557994a96528792302b94762785d64673a401bd0d4fbd3
- MD5 aa5902ca04ccc3f9a39d7e740d9b2b31
- SHA1 cc0f0e1e9ce076b521d8231927f7f9c253682216
- SHA512 1bddf18ccf348d8dc13e490fddc937fed04b89d54846d7129f742ac6b49507548e6a1e08e3e36536970c905b6b791c5aba59c68865a0649dd2f363e23ca2b062
- SSDEEP 196608:cCQerS5FxyOHjMtKYK/F440vcgm1MnkdoZA2vsPZ+MADSGRYQEy:LX2ByOodKe0gBnkdwLvBezQEy
- TLSH
  T156A633AA79C423B1D09BC373D466356E3C3A7F45BBA39C217ACB36580CB1A272275345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion persistence privilege_escalation ransomware execution trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2