b21f261d9f97de7c1b8d890883375235dd5e1984260819e24617c72f7bbcf90a

General

Target
RWLcryptor(2).exe
Size 13.0MB
Sample260913-v5dleatsbw
SHA256 b21f261d9f97de7c1b8d890883375235dd5e1984260819e24617c72f7bbcf90a
MD5 c2940f69dd239f5f1c9a34ad5e0b2a74
SHA1 9a431e788ecc3ffcee937ae5ecc079386aff2306
SHA512 f6201e30ccc13114d73733cce2b80e0818dd889899d7b8c845655973de77c6b1d5afe6ee65a90a50cb0ccc0f5b5f49a25411a7e2ed38cd5d443ebc00945be391
SSDEEP 49152:X6WRmvWDRuAwh9cM90EEbgeeHYQDMnnhXz4kk0000kkkkyyyEAIAIAjvAIykzKaZ:X66huYlKLiJOCuEMrKsa1JuZ
TLSH
T17ED6F93479EB185DB3A79A9E4BD9B5AE4D1DF363230B71BC20B0234B83129418DE5B35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  RWLcryptor(2).exe
- Size 13.0MB
- SHA256 b21f261d9f97de7c1b8d890883375235dd5e1984260819e24617c72f7bbcf90a
- MD5 c2940f69dd239f5f1c9a34ad5e0b2a74
- SHA1 9a431e788ecc3ffcee937ae5ecc079386aff2306
- SHA512 f6201e30ccc13114d73733cce2b80e0818dd889899d7b8c845655973de77c6b1d5afe6ee65a90a50cb0ccc0f5b5f49a25411a7e2ed38cd5d443ebc00945be391
- SSDEEP 49152:X6WRmvWDRuAwh9cM90EEbgeeHYQDMnnhXz4kk0000kkkkyyyEAIAIAjvAIykzKaZ:X66huYlKLiJOCuEMrKsa1JuZ
- TLSH
  T17ED6F93479EB185DB3A79A9E4BD9B5AE4D1DF363230B71BC20B0234B83129418DE5B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence ransomware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (96) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2