67630c059d11b61723be265c46ead60456e9c4de728adffc6761c7e056f81e98

General

Target
67630c059d11b61723be265c46ead60456e9c4de728adffc6761c7e056f81e98
Size 9.8MB
Sample260716-d1q79scs8m
SHA256 67630c059d11b61723be265c46ead60456e9c4de728adffc6761c7e056f81e98
MD5 65c4897b02ed2a039138d3c7b5bae117
SHA1 989ecd6aaf32065ee84add57746b41101137bc89
SHA512 e167fa3d00c680cc6cd6271012a90a1cdd9d26010c9f03f0de30569298789644fa5243ccaa668b48fd2e7023a94b75180105bc5edb1d91f04a07d7f931b47820
SSDEEP 196608:ADu57gLogTkA03LHIMtfiTONYNeFa4ZDiL8net9nCXoWte3MR+DVQ:ADuBgPz03LcO7FvZD0TLnC4WUcR+DVQ
TLSH
T17BA6339CB26587EBE4CA071D1C2B425F5CAD94D6316920F23971CEC66A21FFA83DCD21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835003.msi
- Size 9.9MB
- SHA256 7961716a80646d0557cc8de0e94a1080f90dade09811deab5d60fd7d19209198
- MD5 dc5ce9c47f3f0e8dce49ddf23a5b4640
- SHA1 e5f0223b53ef0a6007608c9761b7f61fb7a59c89
- SHA512 00a9aab29472b848406b3394df77946b2f8e11a47032dc950b7b589bedb01ce401141069edf6a27dd0c378130838b2b01b6f2f866b34d483e3c1679e26e6d81c
- SSDEEP 196608:XFGaXIagdMgPga0ZtneV0HEjfMZO3Y1c14GBdgn4ngtL7CBfJgZkBIl+:AaXJghb0ZtRHOp1FBdafh7C1O+BIl+
- TLSH
  T1D1A633C6B88407BAD0CBC3754827627EB07D7FD17D224C623AA9FB455D3276652BAE00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2