a5da734edd5d6da74e5449bdc11c1bf60b95504a710096f9f507dd8e9be9752b

General

Target
a5da734edd5d6da74e5449bdc11c1bf60b95504a710096f9f507dd8e9be9752b
Size 9.8MB
Sample260715-drrsfadv8x
SHA256 a5da734edd5d6da74e5449bdc11c1bf60b95504a710096f9f507dd8e9be9752b
MD5 b1f974cdcc7a2f7bcfebeceda1cac66e
SHA1 6ed428a33dca5cd47c0dbd16a0213fafff1485f9
SHA512 d3341a9062c4b76b8d526e4df40c67a08a8ab2b2799f5b1bb64b68781dad63bfe465519fb3142c5d1ce928fe248d5e3d6e9f87a877c10f52053c584e5ba29be0
SSDEEP 196608:2z6XT9WoKve1fjQqbnBm9Oq2GVRKQEHgIGjyf4DA1M6rWfj+uIJA6J0SyH:D9NK2dQqbBd6MAILf4DKJrlCpSyH
TLSH
T10EA6333BB3D4A081B427016BE57E26952C3BB169B795FC21EEC3327C4488E9F31B4656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.66tt009.msi
- Size 9.9MB
- SHA256 b1885c7abedd964c4f4e241bb9a196223683141e8ade93be218fdfb02d2982bc
- MD5 71cd43c230c025e3a1afefbd38e835c4
- SHA1 37071e2b4304e4780a04fd61acd1457bbdabbbe5
- SHA512 49b02346579de1b3b66dd3c3bcdbb141c07bb45436eb6ffc0eaca5700c8035ec03f9f5c4652f9698a50bbfc3eeb980a862d166eaaced56f8ad35e5174fadf6a9
- SSDEEP 196608:cCQerS5FxyOHjMtKYK/F440vcgm1MnkdoZA2vsPZ+MADSGRYQEU:LX2ByOodKe0gBnkdwLvBezQEU
- TLSH
  T1E4A633AA79C423B1D09BC373D466356E3C3A7F45BBA39C217ACB36580CB1A272275345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2