2a4bcce1e25b7521f9e8cede1ea5befb96d387830412230bcc733d60c490e083

General

Target
2a4bcce1e25b7521f9e8cede1ea5befb96d387830412230bcc733d60c490e083
Size 9.4MB
Sample260716-e78xbsgw6z
SHA256 2a4bcce1e25b7521f9e8cede1ea5befb96d387830412230bcc733d60c490e083
MD5 01568563d59e095218b1726632a45da0
SHA1 1a23af367903ed76c055d548df374631e393bc18
SHA512 4f360b0d3ade0deb77965629195db9170685ebc24b0bd43eafd23df1578349709baeb167d1eb484da0f7e30698fbaa2cbd32fd22ceb0fbd750a120fb17f7db76
SSDEEP 196608:g8p13N87Z2OdfYszWrXcCEflb2v9/R16qoSMg7USbE1SYD8sUwRBXTD:g8p5NWZNfCxi2hKhS0U+P
TLSH
T13DA63341AAD77ACAF1028E67B80367EA7234D6500F40DF2CDD47A9865A227CFDC4E947
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835004.msi
- Size 9.6MB
- SHA256 cf8a4d6eb0ea59fcc3f1674f0ad6837128b7e85217b64c07f785b9b6bd128fcd
- MD5 1554df461e10f2c05abe0c314b76a48e
- SHA1 e404ab74cfc00dedcf4dee9f5b3ecbc0c0682efa
- SHA512 0e4f872d2e3bbfaffc1afd022c28dbd3afcf75d259fdccbbbc5054aa6b4e145fa5fcd327aab52af5cda18af09088ecfac0f688efa88312f33d7412ffcccc818a
- SSDEEP 196608:0JeyvPhN43p2OHX0g5+3rJw3GErehaiTXfRF6+Acc4NagVOts6Dy81wpnTZ6:k/vpNQp3XSzE7if+Xsa10o
- TLSH
  T1A5A6339079CA77F2C083CBB16003A6AE713D7FD47E228E0A7A5936454D3271F997A346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion persistence privilege_escalation ransomware execution trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2