a44c87ae3f7fae512d76a68afefbcaa1da94d776d81c8a3a91c464d4a6cc54ce

General

Target
a44c87ae3f7fae512d76a68afefbcaa1da94d776d81c8a3a91c464d4a6cc54ce
Size 5.7MB
Sample260716-j28rlaf18p
SHA256 a44c87ae3f7fae512d76a68afefbcaa1da94d776d81c8a3a91c464d4a6cc54ce
MD5 601aecb6c29d7ebd5e254c712b8a7993
SHA1 c92e52245a0df0caf4f3f6bee1f940074e32cb8e
SHA512 69a301b3a71e187423ee8d7493e399b67c8e282b300a8867949f5109dbb233fdeca7b32f8a7acef3cc929f6379d742070dad228e294c1d9301ba7436c5c62e16
SSDEEP 98304:aHW2XQ0MeJsLWtkxOhDATk4E1MTUF5JCHHwxOaHSmFKPtxY/XiUxWRo/JfVNiKyU:MpA7eJQWtkxO+QTuTU7VprYfqXiUx1/X
TLSH
T11E5633C98ED2EC005817BE5ADB17A056C1C89562EBAC033DCDF061ACF3F6664158FAD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835007.msi
- Size 5.9MB
- SHA256 e5106d998fdfc1e4f758b185674dd7f6efcbbe2a38926e68df0790b95b4a4c75
- MD5 1acd958b4c8047a9428b070c9f7d3592
- SHA1 7d5aba4e4d99efd6cb0afdb7cad00619e9eefa98
- SHA512 c18405f549584875801d4d36b52a25af94d1a2628f6d28d9265db1192ec5670e4752ba1f10b51f7df4503dadf56e1694a39689d2a2d154cb93b016fc02cf1ddd
- SSDEEP 98304:OFeTDoyHcRytONJkJkg+h6HoFDrWRH83oa7ukMu32IvFKuZyziO5qRnffFVNW0QI:OFhOcRytOgiHAHo1/F3MKn1yziO5afwM
- TLSH
  T14B5633C67CC22E31C08BCB71C143343EBD697F52BA668D0BBDD531546EB222556BA782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2