8ea4f9ae650ba1fbe211f72403d78038d132ac3d8c5b3610a29eb5e8910b037e

General

Target
WindowsHostManager.exe
Size 5.7MB
Sample260919-sdkvassbrc
SHA256 8ea4f9ae650ba1fbe211f72403d78038d132ac3d8c5b3610a29eb5e8910b037e
MD5 c09c5477572a24cb704fe54e7331f725
SHA1 7f5eb2bfd3b1ee98a9424d9b153ba9f5433146fb
SHA512 9d1d354debb39903d351970c4facc761eae2d6555267cdf77efce9945c8e1d154be6880ddc74aa00369354a0c7411370e437c7c66db2160c1d89266a3f99e12c
SSDEEP 98304:+FPEHO6+91zQ652DXyJFq1894garA7X0SSWnm5KOege4G57i3QL02:+F+O6+9aD2K1dg7Lhm2A3L2
TLSH
T1BA5633FF4A46F9FBF289CB37C4A355EE093A10639688966D9110764310746CAF960BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  WindowsHostManager.exe
- Size 5.7MB
- SHA256 8ea4f9ae650ba1fbe211f72403d78038d132ac3d8c5b3610a29eb5e8910b037e
- MD5 c09c5477572a24cb704fe54e7331f725
- SHA1 7f5eb2bfd3b1ee98a9424d9b153ba9f5433146fb
- SHA512 9d1d354debb39903d351970c4facc761eae2d6555267cdf77efce9945c8e1d154be6880ddc74aa00369354a0c7411370e437c7c66db2160c1d89266a3f99e12c
- SSDEEP 98304:+FPEHO6+91zQ652DXyJFq1894garA7X0SSWnm5KOege4G57i3QL02:+F+O6+9aD2K1dg7Lhm2A3L2
- TLSH
  T1BA5633FF4A46F9FBF289CB37C4A355EE093A10639688966D9110764310746CAF960BFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution trojan discovery persistence ransomware
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (101) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Downloads MZ/PE file
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2