dc5a5d1db40bb2acf8361c772b6e59f5bbb3a53aa71616f40549196db3b2f472

General

Target
dc5a5d1db40bb2acf8361c772b6e59f5bbb3a53aa71616f40549196db3b2f472
Size 6.6MB
Sample260717-efty4aes7w
SHA256 dc5a5d1db40bb2acf8361c772b6e59f5bbb3a53aa71616f40549196db3b2f472
MD5 d87ac8800c6bba20e59492824d1fe02e
SHA1 dd313811b62ba92242655e8562880c1e25fae6e9
SHA512 565ae3fe1dd145f1ae710f835e76e6507ef89754da2a0273eb6ba863cc43cab976e27c8e3762e0c3810b9758ce7cfeadb8d34fd232603fd034d7af1cea0baada
SSDEEP 196608:UPseXr8PkmYxksiCjgz3Vsyt55tz1AW6pL0TWDk++iVG:UPVXkkmdsirz3VsrvL0TWD7U
TLSH
T1C066333861F69CC769B9C4B3EB641D990DC1B7F6620BB0D25F109CB4B03294D9E8B396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intall_app.66553013.msi
- Size 6.7MB
- SHA256 30994dcb61ff39a4ad091bb980271387073ba6aa153aba40356e2522675e7f22
- MD5 cade41fda429e85c4820332ff5386302
- SHA1 7e46b8841ae8e2fe2a05b638e77d03f4bd906b78
- SHA512 7afef88caad82354a82a1b6c9446c972cbec941eec529e18ecd84e2099e6a9e173f72fc744a1842ac3fc7380252b9ee94f91cf78ebb0becfc01e6e2c74618cf8
- SSDEEP 196608:i1tIOHi9gWYlWCwCdEhF2+SMF0rRVMce59UR4vamkSpe:G8gWbCwPhlSMvd9UR4vxg
- TLSH
  T1E86633E97CC52EB2D4DBC3B2A512386E3C5B7FD97A178C463E483A101E7220A1977356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2