8faa95544ddd83836b94e0e1273a4d1667310d8b2ef03e3a562e0e88e7777b19

General

Target
8faa95544ddd83836b94e0e1273a4d1667310d8b2ef03e3a562e0e88e7777b19
Size 8.3MB
Sample260716-bre3jaas3q
SHA256 8faa95544ddd83836b94e0e1273a4d1667310d8b2ef03e3a562e0e88e7777b19
MD5 96c1206978a1e742e2578d84c751f541
SHA1 b656c933dee61f3a37d72fcce6c48bd239a5da16
SHA512 fe7da49726af818c5b77b5581af6e6339f7d70d7671b279a8fd20bdaab3bd305d7ebc5b8f3b91d9d408bc085c2853e4044d8ef73a825f5fdbd5496012967da3c
SSDEEP 196608:Myz5lDptNkppY/Fi7d3cvDtJheCUQdMLObADqEeRqmpuXh2axbS:MOKf2FUdsJheCUQKSZE8WR2eS
TLSH
T15F9633CBF27C65020F1D2245F6DE4D50626F0160D2BFA5F3299AB5307B9E1DEB68881B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835001.msi
- Size 8.5MB
- SHA256 5e93a98826ceb279609778de8bfa6a620fdf857220e29208bc5731d29bd48474
- MD5 89e25dc492d5d32f9a5982578f15c9c1
- SHA1 35b25f6edf09bbc66bfcc175e7c37f328013e6e8
- SHA512 ce639648dab6beeb1a9a23b090747a87ce4f81364abb23633f6543fc6f37dd1cbfe1d8e491de808fcb574aa385385a302ff8768a5df7ed25bd1f0b3ed293371b
- SSDEEP 196608:3mxpLJvhHNIf4HqLybF8totkJldX5uC8QLaL0b2joeKXC6JQyrlWmRbJ:3mlAfiXbF8to+X5uC8QWwZeSOyhWkJ
- TLSH
  T1289633C3B9693731C68BC3B092862D2C7D1E3F41B77A8C237A9979205EB63575339606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2