496ec2ef0f73e1a07e3703e2aa673b3dbc405392a94960b462e6991837b76ac6

General

Target
496ec2ef0f73e1a07e3703e2aa673b3dbc405392a94960b462e6991837b76ac6
Size 9.4MB
Sample260716-e9c8fads7m
SHA256 496ec2ef0f73e1a07e3703e2aa673b3dbc405392a94960b462e6991837b76ac6
MD5 5648e74b44e9e3e2f4dd6f57b92d0212
SHA1 24668065e1ed7b7955e9aa8178a0e3a6b4f9a380
SHA512 5890920539e1fe6230fa935db645582ed916a256f26ec55da99892792dfd82b67a6542a632c9123fe27859938d5a7a94339aac369bdb4cd9527f37f80205fca1
SSDEEP 196608:E8p13N87Z2OdfYszWrXcCEflb2v9/R16qoSMg7USbE1SYD8sUwRBXTN:E8p5NWZNfCxi2hKhS0U+x
TLSH
T12DA63341AADB7ACAF1028E67B80357EA7234D6501F00DF2CDD47A9865A227CFDC4E947
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835004.msi
- Size 9.6MB
- SHA256 3c931b5b9097ae3f723a033362db9af640500234fffe28d0f971b5944c00d3bc
- MD5 13f7cd88930f81a656c05d69975b1d34
- SHA1 9833c997b6809ee6b4b13e818e84aa30860e0955
- SHA512 c5e2c9911f17c9050c09552d145d5b532255613c77817e3d15d66ae1a42c66e4bc83d5dc69cedaacf9b66d6cb738594d182d72e1bcd85edbf6519087383232d6
- SSDEEP 196608:0JeyvPhN43p2OHX0g5+3rJw3GErehaiTXfRF6+Acc4NagVOts6Dy81wpnTZC:k/vpNQp3XSzE7if+Xsa10Q
- TLSH
  T1A6A6339079CA77F2C083CBB16003A6AE713D7FD47E228E0A7A5936454D3271F997A346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2