f4c1c5dda6e192ed15c587620d28138b39021818a53e8bb6ab5daa0a28dea9c5

General

Target
f4c1c5dda6e192ed15c587620d28138b39021818a53e8bb6ab5daa0a28dea9c5
Size 9.8MB
Sample260716-d7nqqafx71
SHA256 f4c1c5dda6e192ed15c587620d28138b39021818a53e8bb6ab5daa0a28dea9c5
MD5 fceb3428081ecb975dd0fc6ed31c7667
SHA1 290d114e319a81595384df185ba76081f0c33f6b
SHA512 57252a99fe9cb74731fbcda3f0366211fb879f61c7bd4a0ad21bba4ae86a89f6165747d6f4d38454ccb17b0f27b4a8960aadcf7d851fa27fb065174eb2da5309
SSDEEP 196608:aDu57gLogTkA03LHIMtfiTONYNeFa4ZDiL8net9nCXoWte3MR+DVy:aDuBgPz03LcO7FvZD0TLnC4WUcR+DVy
TLSH
T144A6339CB26587EBE4CA071D1C2B425F5CAD94D6316920F23971CEC66A21FFA83DCD21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835003.msi
- Size 9.9MB
- SHA256 cbe0aeb28918512fa1a176159b69752bc346b9de3b2a0764fc7f4b4dfb03d3be
- MD5 b8adf7482a79e6ac502c4ee24d8bff7a
- SHA1 43c0dfda1a7451c983f88ac9c894c3efcebe18bf
- SHA512 ab0c4d98d86f9ce54386b663c8699a6b6f062c1506d89c6a53a3a9b4f7dd04404489f0756c2b733bda637f975da7fb62b328c034966c681f9e6e33eaad243b45
- SSDEEP 196608:XFGaXIagdMgPga0ZtneV0HEjfMZO3Y1c14GBdgn4ngtL7CBfJgZkBIl5:AaXJghb0ZtRHOp1FBdafh7C1O+BIl5
- TLSH
  T140A633C6B88407BAD0CBC3754827627EB07D7FD17D224C623AA9FB455D3276652BAE00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2