c1bedfabfb35a690a203161ad0587c964283b97d7ccc50448bbd454942fa512f

General

Target
windowssecurity.exe
Size 116.9MB
Sample261030-n3emcsby3w
SHA256 c1bedfabfb35a690a203161ad0587c964283b97d7ccc50448bbd454942fa512f
MD5 da1c05ab91a009de7a96bed71e922875
SHA1 475011538aaf6e6c5eb0dab14924cbc19aa24ee1
SHA512 fe74a404672f93cad042b163ae125b7d9ea303cc87a1b1eb587eb5993eecfe0a769bf92c99cbb1ecf006fc2e2579513a11884861a176e0f4657a808a19be352c
SSDEEP 3145728:cGk7TWcDDZtrio2ij0/kd0xk7fjyEu5R3GgfPtwEsM5/X5D:2THD7iuPRLsD3GICKVt
TLSH
T1904833A4AF8A37D1F143C534E178EB346DA01158B7D38F8B3B8053A27563DE6A172963
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  windowssecurity.exe
- Size 116.9MB
- SHA256 c1bedfabfb35a690a203161ad0587c964283b97d7ccc50448bbd454942fa512f
- MD5 da1c05ab91a009de7a96bed71e922875
- SHA1 475011538aaf6e6c5eb0dab14924cbc19aa24ee1
- SHA512 fe74a404672f93cad042b163ae125b7d9ea303cc87a1b1eb587eb5993eecfe0a769bf92c99cbb1ecf006fc2e2579513a11884861a176e0f4657a808a19be352c
- SSDEEP 3145728:cGk7TWcDDZtrio2ij0/kd0xk7fjyEu5R3GgfPtwEsM5/X5D:2THD7iuPRLsD3GICKVt
- TLSH
  T1904833A4AF8A37D1F143C534E178EB346DA01158B7D38F8B3B8053A27563DE6A172963
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
- Drops file in System32 directory
behavioral1