Extracted

• • Target
    WindowsHostManager.exe
  • Size 5.7MB
  • SHA256 c5d05af1708d77551febb0cdfa51b80b2a6452dc7b415b29c403c2c98cc686d3
  • MD5 5d83cd6c32fcab266fb789d0f99d7506
  • SHA1 a312e7ba77709e7d53ab83f2a581ec7a2353fe04
  • SHA512 c3e7ccc2fe93e9c4f6f513621de951eb9cf6f66523e048871e1a2b99a5d8ecc800c4009ccd2ce213ac8fd09c32c26fc812753476809a71b1171ba9c5ef92fea1
  • SSDEEP 98304:Yz8SyqMvxQ8YzIjUZ14QSvP7g9hHYHLgUK9joKXsjN:YzVyV5QVkjUcg9h4rgUK9joKXs
  • TLSH
    T1515633EF8B99F2CBD3A4C7776C3344C289B2A59B2166959F0124B823488D1DDB5903FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionaesthetic_stealerpersistencestealertrojanransomware

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Family: AestheticStealer

    AestheticStealer is a Windows stealer written in C#.

    stealeraesthetic_stealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (81) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2