fa285f93a5531250c0ec29e6933879e069f949be8bbb7bbdc31e64e4f26fe6ad

General

Target
fa285f93a5531250c0ec29e6933879e069f949be8bbb7bbdc31e64e4f26fe6ad
Size 9.5MB
Sample260717-nbb26adv5y
SHA256 fa285f93a5531250c0ec29e6933879e069f949be8bbb7bbdc31e64e4f26fe6ad
MD5 9c37a8d3a8e05fcfb7fc92910a453cfb
SHA1 88048198370777340722e10bdc0ac7434972be0b
SHA512 1e58c9e0df388c462193d0b2b58448cecdd022bdbaa95ae9c749f842f3f724af96aea6a61064e30f9e3b7954f0af297b891f318bf5ca6784b64acb0ff974aaec
SSDEEP 196608:6EXlclfN96p5s5mwkz7wlxKV2A10uuK3DAXQW/ehIQ:Zlo196zsAogWuuK8XQWjQ
TLSH
T112A6334F06C678E50F3EA959ED9FA81F5497364623A40DCABFE8359086311BC16F3A81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intall_app.66553007.msi
- Size 9.6MB
- SHA256 572266e8dad8db70379e0b7cb9f24540f9c36fd8efdc28f0275c8524fa0a3676
- MD5 8f916794280b0d21cbdcb994d62e089c
- SHA1 4b0ffde7303f6f5f76f7c6ea1c8e48621b2a3970
- SHA512 0b031559c798f0f47fbdb05101c5f647c8c247e80743f041f1ee313560d462f2c7e8aef92642cb8e4df0365d81dccc2c3ec44025d2c2c4c10daaf362076dc2d9
- SSDEEP 196608:JODQ9ShbeHEsQzJkSb4WJGsGi9TOR2QxaL8Kr:JODQ9SBekqMwsGiAR2QzKr
- TLSH
  T169A633C629C63BB5C46BC3749947B82E70AA3FC57AB54C8A7FD876444B3222815F3B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2