8d16bd080d1918a3ca9c1952f8f65168110598b0970e0c262c126efcd414b5e1

General

Target
8d16bd080d1918a3ca9c1952f8f65168110598b0970e0c262c126efcd414b5e1
Size 8.3MB
Sample260715-194ahsav3v
SHA256 8d16bd080d1918a3ca9c1952f8f65168110598b0970e0c262c126efcd414b5e1
MD5 031e0eaa071deaa9f5464690e4904081
SHA1 c649d85ee9924d3d775ab0132350375bbe2cc4fc
SHA512 0dc3565e3dcb633df168d4a26eb545d11039f4e604bfbbb405c3779de73baff8a33d51160fc6b922e877576370fcea11bcde44a94f1c95cb42da6255df43e698
SSDEEP 196608:8yz5lDptNkppY/Fi7d3cvDtJheCUQdMLObADqEeRqmpuXh2axbI:8OKf2FUdsJheCUQKSZE8WR2eI
TLSH
T1159633CBF27C25024F1D2245F69E4D50626F0160E37FA5B3299AB530BBDE1DEB64881B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835001.msi
- Size 8.5MB
- SHA256 73b018e96083a6a009e20fa55bd83a64fc0f565594bc695fd89339aeecedb1f8
- MD5 73e5d2a007ea403b74974582048c1b57
- SHA1 a575a96eb632427da2c3d0e21bb442148ba7fbd5
- SHA512 64a38ef1e7ae72389e754d5cc1e9e51f371026f470641bf1ca06c2755687e95a1f5826bf941fcdcefe5442f94998edffa25c8cc2b791b62d1761ed59616c84aa
- SSDEEP 196608:3mxpLJvhHNIf4HqLybF8totkJldX5uC8QLaL0b2joeKXC6JQyrlWmRbX:3mlAfiXbF8to+X5uC8QWwZeSOyhWkX
- TLSH
  T1D29633C3B9693731C68BC3B092862D2C7D1E3F41B77A8C237A9979205EB63575339606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2