9f3341ff8af8cc05f1e527f2a46f9c2288f88464cdbdc20538670b424f858604

General

Target
RWLcryptor.exe
Size 12.7MB
Sample260913-vsp4nsar8t
SHA256 9f3341ff8af8cc05f1e527f2a46f9c2288f88464cdbdc20538670b424f858604
MD5 9b4aeb27d48cf329d59e9cb8259d0045
SHA1 127436750a364d7f0df456abf4120a1598f98faf
SHA512 44324223c19c0a0806e396730ee78e4bcc892eab67f95f1fc425b272695ae45f6b57466dcabdc723e7bd75fc7dc51686eb8ca7e718ea711a071c2a871b4d633d
SSDEEP 49152:AelTRmvWDRuAwh9cM90EEbgeeHYQDMnnhXz4kk0000kkkkyyyEAIAIAjvAIykzK7:AelEhuYlKLiJOCuEMrKsa1JuZ
TLSH
T150D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B31B82070234B83129418DE5B35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  RWLcryptor.exe
- Size 12.7MB
- SHA256 9f3341ff8af8cc05f1e527f2a46f9c2288f88464cdbdc20538670b424f858604
- MD5 9b4aeb27d48cf329d59e9cb8259d0045
- SHA1 127436750a364d7f0df456abf4120a1598f98faf
- SHA512 44324223c19c0a0806e396730ee78e4bcc892eab67f95f1fc425b272695ae45f6b57466dcabdc723e7bd75fc7dc51686eb8ca7e718ea711a071c2a871b4d633d
- SSDEEP 49152:AelTRmvWDRuAwh9cM90EEbgeeHYQDMnnhXz4kk0000kkkkyyyEAIAIAjvAIykzK7:AelEhuYlKLiJOCuEMrKsa1JuZ
- TLSH
  T150D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B31B82070234B83129418DE5B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion persistence ransomware trojan execution
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (108) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2