9744a1982bcab68f3a67af360571b602867512dc547f13fdbbdf75e838380a40

General

Target
WindowsHostManager(16).exe
Size 5.3MB
Sample260913-p86hpsgn7y
SHA256 9744a1982bcab68f3a67af360571b602867512dc547f13fdbbdf75e838380a40
MD5 8e060deb913fef56a06c7235dccfea7d
SHA1 33cd2e17d21a463aefc974ca846a186cb0c861b7
SHA512 76278bac8aab305836e8be90aecd05f814b4dd0f1c196f9483e56ac509c55d43c06f0899c6e1869a1340c8922238e8e9c5bddc17b769cc4364b72d7981a61d31
SSDEEP 98304:b+iFLhgt7ROWWTQWZJVBNVdhm5nlotU93QdGDa9lyipdHqMPSlqH0HWjrDLuAPu:b+iZEOBQWH7WnlotUydGu9ly2dvPSZWW
TLSH
T10F4633C3C2DFDBBBFB666676B5E1E334CC1E4E2051AA00A4BE005A51D7B5E1E436E205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  WindowsHostManager(16).exe
- Size 5.3MB
- SHA256 9744a1982bcab68f3a67af360571b602867512dc547f13fdbbdf75e838380a40
- MD5 8e060deb913fef56a06c7235dccfea7d
- SHA1 33cd2e17d21a463aefc974ca846a186cb0c861b7
- SHA512 76278bac8aab305836e8be90aecd05f814b4dd0f1c196f9483e56ac509c55d43c06f0899c6e1869a1340c8922238e8e9c5bddc17b769cc4364b72d7981a61d31
- SSDEEP 98304:b+iFLhgt7ROWWTQWZJVBNVdhm5nlotU93QdGDa9lyipdHqMPSlqH0HWjrDLuAPu:b+iZEOBQWH7WnlotUydGu9ly2dvPSZWW
- TLSH
  T10F4633C3C2DFDBBBFB666676B5E1E334CC1E4E2051AA00A4BE005A51D7B5E1E436E205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence spyware stealer trojan ransomware
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (87) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2