777cc914c2390d04676f7f3fe191dcc39a66836af0ba3998b07c5b73064424d2

General

Target
777cc914c2390d04676f7f3fe191dcc39a66836af0ba3998b07c5b73064424d2
Size 5.5MB
Sample260721-pyxg2swdma
SHA256 777cc914c2390d04676f7f3fe191dcc39a66836af0ba3998b07c5b73064424d2
MD5 1ee5a2a514ce32fc24f8967eb68849c1
SHA1 cce690f3708ca0513461962cc2962c5898f4f0e9
SHA512 789970ef869d3af089bcf23098c78e7a3f4445a94b04d70b5a6893ba3100482a5c76d5786d97f74a8e57b97f0c934763a06b5ea9378156c3c51a15fd95e94360
SSDEEP 98304:l607dZ3B7Z+ybtAyRWEw9oQfHJmM3MkvTG5WQ1ZbYZQFbYekwzrKRrW0ANjCZkXW:t5ZRYybSkw9ocmcvhKFYZQFrzzrKRr33
TLSH
T1E34633398BB0FC03A25846567A680C292D723D7C0AE493570D94A7C78E976FB7B63D0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appstup.32.0.6860008.msi
- Size 5.6MB
- SHA256 becca226e441c7f6577ea507cbcb2852680317e5fd0a72adf294e48bbfddd13c
- MD5 524832c11d05cfd620cd8ad3bb06b9dc
- SHA1 c0c01dccc41a508ad2465d83130e501847cbcc6c
- SHA512 2a67855365109e8d3ee58c5b8857df73bfb067b6510c3a0e88488b9d219647b178f95d189a92c0b871fd59a10217a5ba96efd6b380bb9d29f9dd0bfdc1169b41
- SSDEEP 98304:T0UvY6O1n32BtAubcEinAQNH7EM9q4vdG5mA1/TqaHYTvbKZQJniBYw6a1r2Prci:AUvYJ52BS0inAoEGvJE7qa4TbpNif1rW
- TLSH
  T1C05633897AC1BF31C0D7C3B1625320BD352C3FD96D728E1779E836844E73A2A6576A09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion persistence privilege_escalation ransomware discovery execution exploit trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2