Extracted

• • Target
    vingryo64.exe
  • Size 8.0MB
  • SHA256 13b416c4f1f20744bc0fc0a364cd7628ea3bd66a5daee50a591259194ed758fe
  • MD5 c65180ebd7ae9dfccd178aa7d5b7eb63
  • SHA1 88eeeeb82409e2458ce9977e5d5704ee9c9044bb
  • SHA512 439611c8d2b8a720bf0c81cfc2a870f3cd8f6080c475a4c793a064ccb0685d3d5e07f47b44515266852ddbd27b14302bc328b3155ae747f20a53bbea374577fa
  • SSDEEP 98304:rRrjGQ0nuaZ0Qj3SmizouZhCMYkcIt5FkOwSrIcUsLXRL5gE1i+bVn7wbGp8F6Re:r1kuo0Qb+ourH/P/XRLieiYKs2KKDF
  • TLSH
    T1E486333896A815EBFDF7D239C861D8A2C25A7A161B55C6D783B4C0A00D737C0BA3B717
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceransomware

  • Clears Windows event logs

    defense_evasionransomware

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2