11910639581fa63e01da2b309d29cb85588ca5607c140d94e5ea6a22fab4f6fa

General

Target
11910639581fa63e01da2b309d29cb85588ca5607c140d94e5ea6a22fab4f6fa
Size 7.5MB
Sample260715-cpffyscv5y
SHA256 11910639581fa63e01da2b309d29cb85588ca5607c140d94e5ea6a22fab4f6fa
MD5 3959e89f8487217a1ecda7b9a5145600
SHA1 f0404fa239dd1ac4cd6ca19d6ce84ef239113be4
SHA512 20e9e639fa93efd9f1696f87ef6ccf4f1600c8e0560bbafcb724789668d5aae97ceb13dee7724447b0e9e507f9e2e581f36e2f078f34d06236a3f0d8ce22e428
SSDEEP 196608:gTJixzQYkdAYLf3RsjILWDNYCVYzbpXxV3PaGVs:dUnnLfKjI6DGfFs
TLSH
T18B8633CBE768BD12D2FE5CFC6B582F1693148721B8A21174DCD7819BA9E73E96871030
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.6653002.msi
- Size 7.7MB
- SHA256 c06b794c5c86c8db5fde13a7e7df2f55cf1efe558d22c18d82c6559ba2a174dc
- MD5 7887ca4e6e286594c99fde624466a231
- SHA1 5116879f66c7ea1109952aa3931dce5343e6915d
- SHA512 82031c1af77043ce979a75bde4ac92f1887fab6dd9e969e329e2107b2c2a5c26d1856963a4ce791fc0a94ca657f98d35fb557e28ab679cd248cb78362fadbb71
- SSDEEP 196608:SjgnRbYFjuyqHok7syBbO/sZD8gZyzntBx1RzKYDO:ogoiT97syBbOEZQNdO
- TLSH
  T13A8633C6B9C97B31C0ABDBF05103762D312D7FD57DA69C12BAE576006DB33AA64B2210
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2