1d0b074f884a6acaef09c9819240521b89afd13be896d6d6e3ac704b643b51e7

General

Target
1d0b074f884a6acaef09c9819240521b89afd13be896d6d6e3ac704b643b51e7
Size 9.0MB
Sample260714-wsqkwacy41
SHA256 1d0b074f884a6acaef09c9819240521b89afd13be896d6d6e3ac704b643b51e7
MD5 faf2e45c14631329af44ba3c3b6bb261
SHA1 074735dc82ec86775d2660a046b205356c75cfd7
SHA512 eafb5658923a89a9986141284466c09353a9fe20fe479c90e50949c1d119f2a15cde30f58f0327817b80975c43729e37e5a320c8f07cde644790959a257be007
SSDEEP 196608:knDmVVLInD/QR++w/rkYxjYfyaKM7FuVC34MIqPrqIWpKGxW/TimabRwXZ:kCbLID/jdHjYhKM7FuM34MIqPrhWIqWP
TLSH
T13796339647D8E2335D3CCE1C0E528DBC249FF16EDB35694DA0E528B6EA47C16C784A83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.6653001.msi
- Size 9.2MB
- SHA256 efdb3ae33fcbad5d67c90f7ab846f537020e0bd31bf0c4e90e95dc2e4e431a49
- MD5 ba0273ef3b738fa9c909d8781fbf094f
- SHA1 2f588bda08133edf98191ca4c6c0f609f67622d1
- SHA512 8d87fe2ad1fac8bdf25dceb4be863d786af67f0562c33b705d86e6f770f71a723634f067757c2b999d035b099fcf334eb2cb1a4d6611ca0098c7c781c14ce68f
- SSDEEP 196608:fDxx+1nTYRDjcv++mrl9pE9kinRAHbo+hzQHcZSKw0HhOIepEK5E1j2847kTu:65TYpjHl8Jco+hzQ8ZSKw0HhNeikEh2X
- TLSH
  T1A8A633D27DC9A732C09BCBB54A03A9AC315E7FD9BF329C0A76E539609D3242141B5783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2