ff9691358416150f9aba18ef0a5017154bdeffa7c2e61f2554e414054381635b

General

Target
ff9691358416150f9aba18ef0a5017154bdeffa7c2e61f2554e414054381635b
Size 7.0MB
Sample260716-e4y8qac14m
SHA256 ff9691358416150f9aba18ef0a5017154bdeffa7c2e61f2554e414054381635b
MD5 020396e98f99319ebbd9cef9f9758bc3
SHA1 a8476fa543c0ced626c4a5343d3da5be238a78ec
SHA512 dce69837bf649eb0f9ce640f0260cf1105dcc6aeaf6477c52e7572a769df01a134af36c2c7715820171983499e022e7019466130da961a776c96a75a7b81ac58
SSDEEP 196608:TNn8xnJy+PNfBCK1lOxIC/nDh9IXdHKwSCiTOy:cMiNfBBlOXh9+Hli6y
TLSH
T11276336F0DE8E0FBA136A545CFCD312D995E30613E891717E15271B7229CB23284EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835005.msi
- Size 7.2MB
- SHA256 40159e55d986dbd2adc9fc6a952f059adea46b5eb351b3da204ca6fdfa1ee1fa
- MD5 8c8623c034431af6fc53c084f32ab77a
- SHA1 3c2a5c2eb944b867118643b4ee530f33951f49bc
- SHA512 8ec14a97d708232cd9d75dbaeafe08d2e847562fbaa10d2a15cf7ffdb76039d50a8fd1f06a6f338dcded2a2ca96411b285e84846077956851f3b551bce3b1755
- SSDEEP 196608:aNszuSrjTkP4gJJufIgnv1t9GRPHmimAiLOw:aNlIjTirJu5t9aHTiSw
- TLSH
  T15D76339A2CC9B7B6D05BC3B08647703E782D3FC27E6A4D03B2D836111D7171629BAB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2