7ff332a7646f755d1d952d7e46ebb237bd1aee1b18f0647b9040c81e84722328

General

Target
7ff332a7646f755d1d952d7e46ebb237bd1aee1b18f0647b9040c81e84722328
Size 6.9MB
Sample260716-ctklgaex4s
SHA256 7ff332a7646f755d1d952d7e46ebb237bd1aee1b18f0647b9040c81e84722328
MD5 aa42866fad286730ccfbe9d5786f0c2e
SHA1 cc04e2e94ef6bbac4927f5a7809a53e5d536ac72
SHA512 07cdf21cd53248f6cbe1f48647c8774e902032944fd3e73c04c57b1ddda2c72778977f4a0a836647ffae9de3c8a7f7ccd851d337e589f0965b7cb09da48340cd
SSDEEP 196608:3c/RJTAaAZdaGIzY8OgltiqZOZtYkT1R7IKEUhK:sZy5ZYGIz8gYGuhIChK
TLSH
T1DA7633CABD9438A22D5EFCB331349FF3BC63B89074150FAA854C345786542ACF85A56B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835002.msi
- Size 7.0MB
- SHA256 f41509de4438644c9ac2dca4f1fde21c66a90c0412d996156cee2e49215063bb
- MD5 c956d14b87c39fd8dbd6ec7b36bce140
- SHA1 ab3bba54211831ecae6c9e33057396dc9b2248e5
- SHA512 a8e64a433c4cdb53db77e749fe25e58c0d4782d5facbf0df6d2a9c4c0525c5a7eed99eb3b3a35b030cf9209a0999a077ef4121397f67a2a0b5c742d487828b3f
- SSDEEP 196608:pC6RRTJKWs5hAw6BRW8oUyfLnn8MEsxTx:pPRRgp5ew6Xzfon84xd
- TLSH
  T1197633C6BDC42672D447DBB2811369AF3D297F90FD228C1B368D34169E323296E36746
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2