362cd24fe4581945c26748cbc4aa3db9e1c68e69c5739cb8d65f51ec7ea4ec9a

General

Target
cat-cryptor-v1.exe
Size 12.7MB
Sample261020-tx31nastft
SHA256 362cd24fe4581945c26748cbc4aa3db9e1c68e69c5739cb8d65f51ec7ea4ec9a
MD5 297f98e0585d1c0c025280c92b7e56dc
SHA1 f6627fbd581ef9ad7c5d22f7bf8c0e22dd41cd40
SHA512 5e9e7718f2533f614d90d7bd2d6ae6a58dfc01f2e042bc6ccad733c335a1240496d73cc83a7c617e893bb262e64b7eb9758973174ebf58abf4f8df6051d979d0
SSDEEP 49152:DJhuYE4KPTw++1Zzzs6fOCuEMr/KsaYgNBeESXZO6i43dNhpeF08eI0/SMASBR0z:DJhuYlKL8JOCuEMrKsa1JuZ
TLSH
T1B7D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B21B82070334B83129418DE5B35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  cat-cryptor-v1.exe
- Size 12.7MB
- SHA256 362cd24fe4581945c26748cbc4aa3db9e1c68e69c5739cb8d65f51ec7ea4ec9a
- MD5 297f98e0585d1c0c025280c92b7e56dc
- SHA1 f6627fbd581ef9ad7c5d22f7bf8c0e22dd41cd40
- SHA512 5e9e7718f2533f614d90d7bd2d6ae6a58dfc01f2e042bc6ccad733c335a1240496d73cc83a7c617e893bb262e64b7eb9758973174ebf58abf4f8df6051d979d0
- SSDEEP 49152:DJhuYE4KPTw++1Zzzs6fOCuEMr/KsaYgNBeESXZO6i43dNhpeF08eI0/SMASBR0z:DJhuYlKL8JOCuEMrKsa1JuZ
- TLSH
  T1B7D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B21B82070334B83129418DE5B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion persistence ransomware trojan execution
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (72) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2