63b46b3c232f59b1db58f8f7fe513823083972e584677143c966bc542a4960dc

General

Target
63b46b3c232f59b1db58f8f7fe513823083972e584677143c966bc542a4960dc
Size 9.8MB
Sample260715-fxkmese191
SHA256 63b46b3c232f59b1db58f8f7fe513823083972e584677143c966bc542a4960dc
MD5 312af8bc35336d7cd4ddfafdd496fa42
SHA1 3345fc8737c3540e7096c8e085adfcdabb250425
SHA512 c6d99807e9ac031c0180c2f0b7fcb1838e4049a47970536526b02475b3a4dd17f5b7f01e50fb67ad517a9c6ce16cd774f9b1752ae965548c695be651868fe8dc
SSDEEP 196608:6z6XT9WoKve1fjQqbnBm9Oq2GVRKQEHgIGjyf4DA1M6rWfj+uIJA6J0SyB:39NK2dQqbBd6MAILf4DKJrlCpSyB
TLSH
T190A6333BB3D4A081B427016BE57E26952C3BB169B795FC21EEC3327C4488E9F31B4656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.66tt009.msi
- Size 9.9MB
- SHA256 fee373dfb37a03daeb5dc5e4c33f442ff8768cb590d744c3d48705274eccc1e7
- MD5 5c45cacff9a4262bbd53f6f061eef875
- SHA1 f493ee66ecf318aede3a6aa08a68a7bc451304f2
- SHA512 ec5d3e15cb267f6dbee2b0f4f330689657a1c9588fb21c64ab840f7ec64563ee7b376da62cbf93a50167e9c7d5c106422fd27a210494cb9ef17b0985c891863a
- SSDEEP 196608:cCQerS5FxyOHjMtKYK/F440vcgm1MnkdoZA2vsPZ+MADSGRYQEr:LX2ByOodKe0gBnkdwLvBezQEr
- TLSH
  T134A633AA79C423B1D09BC373D466356E3C3A7F45BBA39C217ACB36580CB1A272275345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2