d14bb8813e6f71f2eec5f1074957f32f276278f931d7308b59aa6747b839e56a

General

Target
d14bb8813e6f71f2eec5f1074957f32f276278f931d7308b59aa6747b839e56a
Size 7.0MB
Sample260716-ey62dags91
SHA256 d14bb8813e6f71f2eec5f1074957f32f276278f931d7308b59aa6747b839e56a
MD5 1c98bfd3ee85a6a2b9a2347439e23099
SHA1 dcf1b99e0e65c4b9edb9ea67771250ea68d3127f
SHA512 d5802ccc80e3302db362bff40209c352501bf383fc6cae9bf86e9701b90f2d603bbc049c11384413636ed918579d1f9be0bdca00410d27d09861574bb5d3f111
SSDEEP 196608:lNn8xnJy+PNfBCK1lOxIC/nDh9IXdHKwSCiTOC:+MiNfBBlOXh9+Hli6C
TLSH
T1FE76336F0DE8E0FBA136A545CFCD312D995E30613E891717E15271B7229CB23284EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835005.msi
- Size 7.2MB
- SHA256 b4a678e8d8fb95874b8e4801999605251622b9a5cec1187a737bdb084e163716
- MD5 372783b6fc0b7ef0a295fdfc51b5cad7
- SHA1 b37bccefa2cffeae9f8bf7c7d6a540be1cb6b900
- SHA512 de8c864f140cbd661819b0ff0f1dadde1e093c900eb3e1eb952a37e041dc0d7b9afed2f0eec0a198ade35cb9bf51774fdd3adda69baddfc9357fed315df2e9d2
- SSDEEP 196608:aNszuSrjTkP4gJJufIgnv1t9GRPHmimAiLOo:aNlIjTirJu5t9aHTiSo
- TLSH
  T1B576339A2CC9B7B6D05BC3B08647703E782D3FC27E6A4D03B2D836111D7171629BAB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion persistence privilege_escalation ransomware execution trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2