5239108847e773bac1bef5c556d3bd7573c16b5e6c806f84528cbf58a5f0fa05

General

Target
5239108847e773bac1bef5c556d3bd7573c16b5e6c806f84528cbf58a5f0fa05
Size 9.8MB
Sample260716-ffmepadt8q
SHA256 5239108847e773bac1bef5c556d3bd7573c16b5e6c806f84528cbf58a5f0fa05
MD5 128572a24dbb7c65d592589da13a92a3
SHA1 87c754dcb2cf622c44a91675a3498d1e8ad07697
SHA512 999bcb369fad6c1197ce7820abf4927b51e82defadab9a2cd8805864beccddcfc9ae72efd00b60c298377b379d755bea020676ab1104d8863eaec5335056b911
SSDEEP 196608:5Du57gLogTkA03LHIMtfiTONYNeFa4ZDiL8net9nCXoWte3MR+DV+:5DuBgPz03LcO7FvZD0TLnC4WUcR+DV+
TLSH
T1ACA6339CB26587EBE4CA071D1C2B425F5CAD94D6316920F23971CEC66A21FFA83DCD21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835003.msi
- Size 9.9MB
- SHA256 c609ea3313a3c896b086f368715c24292b7900e8438a600232d3e956258722f8
- MD5 07d86f4d02b1f2002d61a007b9bed533
- SHA1 b5478c7a45c1f2c4fe9859e65b373b62e8af720d
- SHA512 59ebf41a2104dea3ec8610cfe402324303f6691d362741afa17aa36ac4a17b12354e22a75a52665194f03d1ccd735b337a0737c77272945367e5109b88a3b9fa
- SSDEEP 196608:XFGaXIagdMgPga0ZtneV0HEjfMZO3Y1c14GBdgn4ngtL7CBfJgZkBIlu:AaXJghb0ZtRHOp1FBdafh7C1O+BIlu
- TLSH
  T159A633C6B88407BAD0CBC3754827627EB07D7FD17D224C623AA9FB455D3276652BAE00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2