0b8d0c09a693b79d246b83842e42a96c569e3c162122fcd352121f593ffc29fe

General

Target
catcrypt.exe
Size 16.2MB
Sample260922-xms99add26
SHA256 0b8d0c09a693b79d246b83842e42a96c569e3c162122fcd352121f593ffc29fe
MD5 71f5d17e4d2aa2113a4c0d9a6b97a8e0
SHA1 6fb904612233834716cde688182c0d1984764dc6
SHA512 a93603229a9a00136b743d4727070528d0103ac70957ca47fbf9d4f9c6310533b1fe0c79a5350c37f1d1fe4ea706668354457825f429338fdaa0c35cffef5a94
SSDEEP 49152:1xn9du9BJAiiWGgt9IPXY32Z0PYriUTkqyDaDXVLh5PAzuKTW/UMXkRRJzS6i0sn:1x9
TLSH
T11A073038B9D518BE7B6759EE87F63A9D5909F3BBB3065D7C20B2314A43039098CE4724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  catcrypt.exe
- Size 16.2MB
- SHA256 0b8d0c09a693b79d246b83842e42a96c569e3c162122fcd352121f593ffc29fe
- MD5 71f5d17e4d2aa2113a4c0d9a6b97a8e0
- SHA1 6fb904612233834716cde688182c0d1984764dc6
- SHA512 a93603229a9a00136b743d4727070528d0103ac70957ca47fbf9d4f9c6310533b1fe0c79a5350c37f1d1fe4ea706668354457825f429338fdaa0c35cffef5a94
- SSDEEP 49152:1xn9du9BJAiiWGgt9IPXY32Z0PYriUTkqyDaDXVLh5PAzuKTW/UMXkRRJzS6i0sn:1x9
- TLSH
  T11A073038B9D518BE7B6759EE87F63A9D5909F3BBB3065D7C20B2314A43039098CE4724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion evasion execution persistence ransomware spyware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Checks whether UAC is enabled
  defense_evasion trojan
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1