4482841669a44765e5619a02ff40d9396161a500d325e14528c28f61b7f7658a

General

Target
4482841669a44765e5619a02ff40d9396161a500d325e14528c28f61b7f7658a
Size 7.9MB
Sample260815-j3fr7sscqd
SHA256 4482841669a44765e5619a02ff40d9396161a500d325e14528c28f61b7f7658a
MD5 26878624e9a8da74548f590b06e8d3b3
SHA1 27ef3bc4236fa33909e18a520f56077db6b37d86
SHA512 4748a8c519de50b9f92684f1092925d7356509d58aa7d87daeb4564a0530fd6b21bad7972c4b6c2f2174f9cf8b2a9643084dc8d6e4e0df20cd99dfaac9e243c9
SSDEEP 196608:V3f3B1iSClAn3uhaGq8jIUNGGaDZ5EUP0jzOhnkw7zM:VDslAn3sa38RhMn30jim
TLSH
T1E686337B877A06877546C5E5F210F62AF88FE391A4D750F7F92246B697C21E0934BC08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinst_up008.msi
- Size 8.1MB
- SHA256 a65e0372580f56f20bdf6d76ec4e163e542ad863b4d9c4f23ccd49d0a0cd3472
- MD5 4a3ff01b07861a54bd01b94a3cea0619
- SHA1 c1fce1ff59138f9a3bfebab76b7fff3388b98e46
- SHA512 866c4f99bd40bb31f65ab477eda9bbd2abbc7cab2cb31ee804ba6823c563d38c03b8f5fd55ada5643e1c3fb7a8444adb5ac29ff3cb1812a79cb11eed5cb7cd81
- SSDEEP 196608:JtGOBc0yTIzDEta+ltfg3qmucWLiaMlLNs6t+3zuLv6oVbD:fGOBSTIzDeaKHmkjSJD+3qp
- TLSH
  T13A8633CABD8E2B71D06BC3F19142746E7C6DBFC5BA638C577AA17A101EB21205337648
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2