af7f3a7e464d20fd61fab3e5d154011ea625ca42b3b91d2e903b224e3d6100a7

General

Target
af7f3a7e464d20fd61fab3e5d154011ea625ca42b3b91d2e903b224e3d6100a7
Size 8.3MB
Sample260716-bq4phadw5v
SHA256 af7f3a7e464d20fd61fab3e5d154011ea625ca42b3b91d2e903b224e3d6100a7
MD5 2123c8cf2f678328ffbee0ed18c59b91
SHA1 80bceda4744b731f8c82076ca7833364f74b297c
SHA512 ca6e98ba4d11ca3ba98e79267c337e4dac5f69b5e0aa428df35e60df8d728e97fc492117143c4df6d60eec8eb41b5948baa6a493a634cf4867385f64fab71afd
SSDEEP 196608:/yz5lDptNkppY/Fi7d3cvDtJheCUQdMLObADqEeRqmpuXh2axbB:/OKf2FUdsJheCUQKSZE8WR2eB
TLSH
T1959633CBF27C25024F1D2245F6EE4D50626F0160D27FA5F3299AB5307B9E1DEBA4881B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835001.msi
- Size 8.5MB
- SHA256 80bf4748d39028f4602ae7195535ebee9ab6324173d24833b2e917f4bcff0354
- MD5 f40904f6a70f0dc424c0c4ff82bee250
- SHA1 d2a2fb73e48dbc5556a998c9ec997f85e84b415e
- SHA512 9e0e97f8323885e94fe38b1eb85b996ba5fc3f02c068aa5e5cd6f6a4ab2dbcec26aea97278ec6f7a9e43896bb52df5ff28c6783b305fc98507a672712cc9d499
- SSDEEP 196608:3mxpLJvhHNIf4HqLybF8totkJldX5uC8QLaL0b2joeKXC6JQyrlWmRb5:3mlAfiXbF8to+X5uC8QWwZeSOyhWk5
- TLSH
  T1659633C3B9693731C68BC3B092862D2C7D1E3F41B77A8C237A9979205EB63575339606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2