b86742cafd41e089bf440a62592984be76a70a1d6bd305fad60201c1dc3bdf6e

General

Target
b86742cafd41e089bf440a62592984be76a70a1d6bd305fad60201c1dc3bdf6e
Size 8.7MB
Sample260721-pf3lcabk7s
SHA256 b86742cafd41e089bf440a62592984be76a70a1d6bd305fad60201c1dc3bdf6e
MD5 13ccc20fd432f74fe6655a79d56c9b34
SHA1 6106b777b115e2117cb3f1bf13c2bc722bfa1e0a
SHA512 8a3468cbafc0a964e633e1e8544cfbdb4f1545f2b06ac7ea780b09893fc6790172ca7ce9c66de6384faacc753d55515eab8742afa7cce1f07486c69476323083
SSDEEP 196608:R7732g61hTVCfkwljjMFFXiuGBhSNVmSrM5VtVGh0cC9j:R77GXtCf7l0TXzIgnm5NA0pt
TLSH
T11E963300F885D0C0A8EDAF59FEB54D30C0F9F43668D3AAA39CEA5BEE1959407997D10D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appstup.32.0.6860009.msi
- Size 8.9MB
- SHA256 b300b394d69fe4bc8afdc2fae1188f27fecbdba4d67a54326280f745fd59a9be
- MD5 33f3a2199e5e11133996aaab5cc0d273
- SHA1 6f1d3d1154fcafaeb6fd2aeb7f99e0d21d5f6ed2
- SHA512 42132fd246b654fc31d355c1a030a4bd815a600d5ea63e9d885d3f824e15cbc9f073e43f883a76b98ab8dea7c93296f386aa633dab8e090bebe85ec22036767c
- SSDEEP 196608:EIsDD3/lmzk8bdvCfciBF9XoOob7kppIwr4rHJlIpwUP6:EjDhmzzbA7f9X3k4DIrfkJy
- TLSH
  T18396338578C866B0D0DBC7B29A53683C74A9BFD67E27DC037AE93B500D736068676309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion persistence privilege_escalation ransomware execution trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2