970519ee9b4dcc31fd1dd8dc20d6f63214631c4561dd58d30e4c4e7b5ea1160e

General

Target
970519ee9b4dcc31fd1dd8dc20d6f63214631c4561dd58d30e4c4e7b5ea1160e
Size 9.8MB
Sample260716-dwvd5acs2q
SHA256 970519ee9b4dcc31fd1dd8dc20d6f63214631c4561dd58d30e4c4e7b5ea1160e
MD5 393b8147d999357f7c1881fc314da902
SHA1 d19a27109f1b43438830e9e795cb29e73f16dbd4
SHA512 cc6ccd649043015704200f1854843fffcd03ffd2e9abd81e9013f5b57b8141a842bb8acc36f791f72a9015cad2f74e43fd48186b55d622acbba2b01729c8a42b
SSDEEP 196608:+Du57gLogTkA03LHIMtfiTONYNeFa4ZDiL8net9nCXoWte3MR+DVf:+DuBgPz03LcO7FvZD0TLnC4WUcR+DVf
TLSH
T1F0A6339CB26587EBE4CA071D1C2B425F5CAD94D6316920F23971CEC66A21FFA83DCD21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835003.msi
- Size 9.9MB
- SHA256 093ae6f0d514aaea81cf70bd459b66c7eb91bf7262ec5c2df354d6f8da55b00c
- MD5 103697cb97fa7aaea75470795f5c1907
- SHA1 f232683bc7465ef1f252e85ab2d67906bd4604fa
- SHA512 674c676bbfd9b4e88fd4f8af4bc5c19554efcbb95fee119be5da0e4c7bd090a43cccf93dc1079a7e983934c6a0c63c18beb437243947a0999276731441413ba7
- SSDEEP 196608:XFGaXIagdMgPga0ZtneV0HEjfMZO3Y1c14GBdgn4ngtL7CBfJgZkBIle:AaXJghb0ZtRHOp1FBdafh7C1O+BIle
- TLSH
  T1AFA633C6B88407BAD0CBC3754827627EB07D7FD17D224C623AA9FB455D3276652BAE00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2