f20613167c50de2ef38cbd5470cd59cb4540a1cc4bc3204af34e9080cfa57ff2

General

Target
f20613167c50de2ef38cbd5470cd59cb4540a1cc4bc3204af34e9080cfa57ff2
Size 8.3MB
Sample260716-ansnsacx51
SHA256 f20613167c50de2ef38cbd5470cd59cb4540a1cc4bc3204af34e9080cfa57ff2
MD5 53dae3776006c3017c489c44166531ee
SHA1 0358e855f88b4bbba1a3d934cef22083d79c0e9c
SHA512 780d088b6b6052829d1ee3237139bc896e6e5b69142cdfc482ed396ccaa26047b82b3808169ca89727457ecdb3cd483955dc1ab0386fccd431060bcc007a7fb8
SSDEEP 196608:Jyz5lDptNkppY/Fi7d3cvDtJheCUQdMLObADqEeRqmpuXh2axbz:JOKf2FUdsJheCUQKSZE8WR2ez
TLSH
T1BC9633CBF27C25024F1D2245F6EE4D50626F0160D27FA5F3299AB5307B9E1DEBA4881B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835001.msi
- Size 8.5MB
- SHA256 f7aff079a1c925b40c0219889619b9c1695cd948e52b8697415ca879843203a3
- MD5 192ce2ec0427ff084010c20c2a0f0e80
- SHA1 c4af5c844b425f818fc127a51cb53283a4b8757e
- SHA512 b5f7871723197a093b4a5a3d0792f305fcbd9c72199ae08c1c5918957d147574696a9c5fc4173db306cc1db9b2a324bb1dca50b10c10ec01dded5ae4758958bc
- SSDEEP 196608:3mxpLJvhHNIf4HqLybF8totkJldX5uC8QLaL0b2joeKXC6JQyrlWmRbB:3mlAfiXbF8to+X5uC8QWwZeSOyhWkB
- TLSH
  T17B9633C3B9693731C68BC3B092862D2C7D1E3F41B77A8C237A9979205EB63575339606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2