4398ac65b4385b1456fa3a865b0faf5ed9854ca370ae89f54028804e7fb6c106

General

Target
4398ac65b4385b1456fa3a865b0faf5ed9854ca370ae89f54028804e7fb6c106
Size 9.3MB
Sample260717-fe9tlaex51
SHA256 4398ac65b4385b1456fa3a865b0faf5ed9854ca370ae89f54028804e7fb6c106
MD5 813899b753d6777459449ae098f9b01d
SHA1 6f77127fd70a40e7631c4d17801c65700b2f5782
SHA512 8703e5042094da2ed2cf34cd217ef7b34fe955c60c82c9edd81f75316be15d2cf729f85a6005a74283a7daac530d3eb506633377cd3823d5c7d0e901ce32d367
SSDEEP 196608:ROFmAt8EyfPjUPh3dRyuop7o3aBRW/tVegQHFwCI7n8hQy2lIy+7tv:RXA73ehpmsWFE5lAzy2ey+7l
TLSH
T1DEA6338728BC5339FA6F9E41A7479F35D5AF2E20AF0DD71AB007577420CE856E223684
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intall_app.66553009.msi
- Size 9.4MB
- SHA256 39b44f17d0575d3ac65d4576d380e816f0e44aba5566bf4ae7e4eb09fce65548
- MD5 8ecda4292fd2e655358b873d27d8918b
- SHA1 0298408f6df0f1c926de405fe6ae40f9b9353a68
- SHA512 1613b7eec7c1733f019c9279164ab20063a19f4a63796e6e381399390878ac5ecc0b3721d73b2ac6406d7eb69aa97928058972373eb0a618b470f8ea340336da
- SSDEEP 196608:docVmMt+E+/nxsXlH7acmvup9F+/IzMvLp1yllPcMMdpIiOBrCwlG8qr6Qy7d4:doZMbHOdv8H6Xyr0xTMy8quQy7S
- TLSH
  T1F4A633C62CC82375D18FCB71A603767C712E3FD4BE5A8D0A715A3B2819F2A2A5177384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2