05c08c356656287f11b292ca145122787116ab0f979bb3cca69c03f0ddbb8352

General

Target
05c08c356656287f11b292ca145122787116ab0f979bb3cca69c03f0ddbb8352
Size 9.5MB
Sample260717-nadjlahw3p
SHA256 05c08c356656287f11b292ca145122787116ab0f979bb3cca69c03f0ddbb8352
MD5 b733dd4274d2c48a5ac539dfe3d7cdb6
SHA1 2e689c2ccadc409e1472af5a6f7b4531e961b38d
SHA512 7ff2a105b3df9c9716552934a0d875ce5944397975f75064d42103e75d5d03c7ff9d25b28d094f8545804df8f14c29280ed7eb2a9335f7c975ff36882422dd29
SSDEEP 196608:eEXlclfN96p5s5mwkz7wlxKV2A10uuK3DAXQW/ehIu:Vlo196zsAogWuuK8XQWju
TLSH
T137A6334F06C674E50F3EAA59ED9FA81F5497364623A40DCABFE8359086311BC16F3A81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intall_app.66553007.msi
- Size 9.6MB
- SHA256 8ee3e9096dea867ff949d0fbd90aca65ea51281b24ae95f30a81e084ae4b50ee
- MD5 ffa87e1ef451c69a24cdc6d86edd7402
- SHA1 91fe8d626bdf295affafc6b84d8e2409fd7f0b80
- SHA512 9dc5b0d27cb5080747be58c64527526badbc2f8e903f8dba987888723ae5b24ca29b750179872e04da36012b2177977f1cb0ed5d15cd4fb02dab29f832fbe591
- SSDEEP 196608:JODQ9ShbeHEsQzJkSb4WJGsGi9TOR2QxaL8KD:JODQ9SBekqMwsGiAR2QzKD
- TLSH
  T1CBA633C629C63BB5C46BC3749947B82E70AA3FC57AB54C8A7FD876444B3222815F3B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2