bee2737a1023e1e938ac34b51c06634f30b82a77cb321699bcd10f43eea9685f

General

Target
bee2737a1023e1e938ac34b51c06634f30b82a77cb321699bcd10f43eea9685f
Size 9.8MB
Sample260715-dvl2csay5r
SHA256 bee2737a1023e1e938ac34b51c06634f30b82a77cb321699bcd10f43eea9685f
MD5 bec0e9debc2fed3e00cbd482c27fa012
SHA1 03781a3b94a6689ab5ca5f66bd9deb71fe8a846a
SHA512 b38551eebc44312bdbed89074b7e8a9756de1f345a8cbd9c68c1a2e67b93f59e860c313862ffe194a1f5643f69a9b371cbc16dca2f88b13f605aadcc6c375b0b
SSDEEP 196608:QKArVbuqDUzz1HwV4xQs7KlS8akkv2Cmxy9Bz8psl5+Xk1:yu6UH1Hwts18DkOCmxK86SU
TLSH
T171A63314B1225B55AF476C76099684713A7CC6C49E93B7B8AF4BECCB180E0DBF71B128
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.6653003.msi
- Size 9.9MB
- SHA256 c7f7de90dc7fb1ff7f40c89027c2c18ccfbb9d99b919fcfcc968e1c2771e4364
- MD5 a1a9bbccbfd67a2c68d7e0ea3681d985
- SHA1 9e901037a6e81ecb6cd1f0966e90a068ec5507c4
- SHA512 808697e813e72469cd54bc8691a32d58ae856aee9654de7b0ab4c1ce33e8cd36d18e0f41ab76e5fd2b3a5a66cbd057c6ff08f69bcbcab3c383dbe73717216fa7
- SSDEEP 196608:DNtT5GAHAlKRAD4lrePyH42IsYJo6GtO73M0b2l/OP8Z:DhGsAGyf2VY+6GtZ0q8u
- TLSH
  T12AB63385B8865B71C087C7714592A0BC317DBFC4BD629D5E7EDABA890E3622BB533304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2