17b7dd1ffc100533f12a7ab665f577b14b387454d670e6e012410e5203df7b8a

General

Target
17b7dd1ffc100533f12a7ab665f577b14b387454d670e6e012410e5203df7b8a
Size 9.8MB
Sample260715-drtl2aax6l
SHA256 17b7dd1ffc100533f12a7ab665f577b14b387454d670e6e012410e5203df7b8a
MD5 9fb7c66c3561d2dd019054cc23bc352f
SHA1 d581dfad28bfbbf01a2aa8134ba60d8decae759c
SHA512 5d164f937428e2abae83a6af09ccb4d83536d5c614a5f70f7658069380180fc600639f0a1e7b3565ea5c06d232fbd95e9e666e9851cfd7a9cb0c4940ebf22ca2
SSDEEP 196608:Uz6XT9WoKve1fjQqbnBm9Oq2GVRKQEHgIGjyf4DA1M6rWfj+uIJA6J0Syf:t9NK2dQqbBd6MAILf4DKJrlCpSyf
TLSH
T19FA6333BB3D4A081B427016BE57E26952C3BB169B795FC21EEC3327C4488E9F31B4656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.66tt009.msi
- Size 9.9MB
- SHA256 bb20f150fc5a6684e49f7fafdfcc3c21f1b0458ed72cf54434482cc3f591b0f5
- MD5 be0796cdaf18995c1879bf758030298b
- SHA1 88e1da22004171489ade32457b3fce7da92c5190
- SHA512 2fb5358082d2795692959064911279ef2ab7ea80906fe1ebf4d7b9b8e90c0e8cdb81e0cb14212ed3ae50bfe6992d90735c0b52150dc21594bb97aecfb399a800
- SSDEEP 196608:cCQerS5FxyOHjMtKYK/F440vcgm1MnkdoZA2vsPZ+MADSGRYQEc:LX2ByOodKe0gBnkdwLvBezQEc
- TLSH
  T17CA633AA79C423B1D09BC373D466356E3C3A7F45BBA39C217ACB36580CB1A272275345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion persistence privilege_escalation ransomware execution trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2