c2021e9ea83149418f2971d2c581715773773be4f1f85bc5b6b95feccb5fb1d8

General

Target
Everything-1.4.1.1032.-setup.exe
Size 501KB
Sample260827-scexnav1c1
SHA256 c2021e9ea83149418f2971d2c581715773773be4f1f85bc5b6b95feccb5fb1d8
MD5 a705d9628ad91a664997f5c129918fb9
SHA1 af2fe751cc24791d5745c499a0d92653226a1e02
SHA512 9b82a998f7ed3954f29afee599996985280478a1635c3dd5e606b10c6a27fe2ac4ee854a46bf70d1d70fd99f12475a22bc2ce23a92d5b2781518debf03b4742d
SSDEEP 6144:sIRAMxRiPmOp5fbimhiQLtlGPEztgi/o3Z+0//jR4s7wMKorGW6hazmj6Sxjzwck:bhiOOXu+iYs8ztgi/op4h3V/Mr+
TLSH
T1D1B429143FA98E08E580253E459E4614DB9AE1F226326303370AFFA25D45DDEDE2D3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Everything-1.4.1.1032.-setup.exe
- Size 501KB
- SHA256 c2021e9ea83149418f2971d2c581715773773be4f1f85bc5b6b95feccb5fb1d8
- MD5 a705d9628ad91a664997f5c129918fb9
- SHA1 af2fe751cc24791d5745c499a0d92653226a1e02
- SHA512 9b82a998f7ed3954f29afee599996985280478a1635c3dd5e606b10c6a27fe2ac4ee854a46bf70d1d70fd99f12475a22bc2ce23a92d5b2781518debf03b4742d
- SSDEEP 6144:sIRAMxRiPmOp5fbimhiQLtlGPEztgi/o3Z+0//jR4s7wMKorGW6hazmj6Sxjzwck:bhiOOXu+iYs8ztgi/op4h3V/Mr+
- TLSH
  T1D1B429143FA98E08E580253E459E4614DB9AE1F226326303370AFFA25D45DDEDE2D3DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution persistence privilege_escalation ransomware
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
behavioral1