4c57094111a429a5a7f9c1cb06754bd6618821f21ce987fefc66c8aa08fb3cfc

General

Target
4c57094111a429a5a7f9c1cb06754bd6618821f21ce987fefc66c8aa08fb3cfc
Size 8.2MB
Sample260716-mqvmdaax3p
SHA256 4c57094111a429a5a7f9c1cb06754bd6618821f21ce987fefc66c8aa08fb3cfc
MD5 5587dc068e0786991ab6f79c87884e0f
SHA1 e85e940814ebe67671c55931fde425aa6fcf204e
SHA512 e204e357fd0f4afca8ddc83b304ef4b04fbc9fda4391a3d86dbaea27f9dec957c385dd5295f0db60c6d4ce6b13029d25ba5c6d9777335f138d8f529dc3c6ea6b
SSDEEP 196608:KX2SQ4a0bHvQbc1o23MlJfyVxxUX7G6MoRrVn:ulna0bm9pfcoZZ
TLSH
T12F96339A0E0AEBBC9D25B0957078F62F19B86877989217DEC806E0434BC0FD56531FDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinstall.8835014.msi
- Size 8.4MB
- SHA256 d4eb9b98b015314ed1ab0451a1a7f05de161efd198359d6bedffcb4a7cdc6fe9
- MD5 6283678909b15d22077c3f478ce321e1
- SHA1 47113bb20e0262c37856ac6f31463d1e61ff1b59
- SHA512 7fd1612e2bfa1573cc9f2391cb2d98e54ffac2fdc3a0925f20248131a078643a19ddfa8b1c7736b06f25b30477604120c683a0593bf99da4505c36ae10ed07aa
- SSDEEP 196608:XFl+CQ6SI7pFQZgZK8dUgwy6+9Cz5kUxte/PSGA69X90r:bJrSI7+lcz6QCz5xMra
- TLSH
  T1CC9633861D86BBB0C587E3B55052B13E3C2D3FD2FC660C4BAD9A75415EB2B21617238B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2