fe0a86348e0d04f2e4acfa12752f5737f84a9567186d0bb7e38b59bddfe7a57f

General

Target
fe0a86348e0d04f2e4acfa12752f5737f84a9567186d0bb7e38b59bddfe7a57f
Size 8.3MB
Sample260716-cx69msbt7r
SHA256 fe0a86348e0d04f2e4acfa12752f5737f84a9567186d0bb7e38b59bddfe7a57f
MD5 5edacbc5620d10b56ba5650e1efb74eb
SHA1 81b3286dde81bd24a3fc60f198033cb32369b359
SHA512 43fe7b27de836ade556b98dca5874ca898808693affac21814c2578caf6de9980a22539e26d363d7748f21c000300e53301e3cd81bbc1f39b2c96989c74778e4
SSDEEP 196608:Myz5lDptNkppY/Fi7d3cvDtJheCUQdMLObADqEeRqmpuXh2axb3:MOKf2FUdsJheCUQKSZE8WR2e3
TLSH
T1229633CBF27C65020F1D2245F69E4D50626F0160D2BFA5F3299AF530BB9E1DEB64881B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835001.msi
- Size 8.5MB
- SHA256 136a3e5d607b87c1cae6f7d583d1b33a5002abc2c849a05323e235db853aa962
- MD5 19c6676c5b92fc3cacedb355453c3da1
- SHA1 378e0f5d306df8b5f157a9edea606b4cd46383a1
- SHA512 fa7253b755684f0fd28743264718f3a03fb9714fb3f78da22f71eb053e0ab09bbc902d0e3e5d65da75eaad52aa0df083ed07eb441e243cd9f9483ded41bcfde7
- SSDEEP 196608:3mxpLJvhHNIf4HqLybF8totkJldX5uC8QLaL0b2joeKXC6JQyrlWmRbE:3mlAfiXbF8to+X5uC8QWwZeSOyhWkE
- TLSH
  T1149633C3B9693731C68BC3B092862D2C7D1E3F41B77A8C237A9979205EB63575339606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2