58089cea68425bc460696ab51c4bb21f5ed04701d9242eba4a254f7034b3eb9b

General

Target
58089cea68425bc460696ab51c4bb21f5ed04701d9242eba4a254f7034b3eb9b
Size 6.0MB
Sample260708-mep8hset5t
SHA256 58089cea68425bc460696ab51c4bb21f5ed04701d9242eba4a254f7034b3eb9b
MD5 4faaaa80a0e321d8666c92fba1d4a126
SHA1 1c6941ab971722d25208239fbeb4e44d06884ba1
SHA512 120d61d5456b43acc2576d6bd11da091d6fc90b0962069694b10d425eca3d875de50fa51c078a778fcab934c3483f6b682feaa56c32db7603cc1ae96ecf19d0b
SSDEEP 98304:IS3LVBA/Dimq2COoNbv+kkF48LUTKzXfdVHDkx6T1n4GIwi5/317bHm5PrpXyang:IS3p+re6VXz1VHI0TxFg7bH0dXyCg
TLSH
T15056336902115FA993DC9E4CE8569381E3310FE30BF53BDAF23ED016B6C19939A16D9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  aintall.6638250005.msi
- Size 6.1MB
- SHA256 ceef19e40368bf533c30708fc8d1a5d114a5ece7d4fe5d488e6a26dc8a532074
- MD5 cdb429897b37757c7d4f4ce83bdfe840
- SHA1 fe55a6bde8be7aa52ab9d5885f2a223cb0ff522c
- SHA512 563bd9b110b3bd68ca842931b5102c3995349541a174b07abed52c521db2fd4184ed8788395edb198395f68c1b552f6962c2cf664d9fd5359f3bdf94c86ed410
- SSDEEP 196608:k366rQQPrV5poAI7xIXJjtlOhbzkrNm+g:k366MQTvIFI5jt4hc9g
- TLSH
  T1F756334BB6CA5BBAD08BEB78D10A92AE70393FC24F745E5731EDB91C5EB21204671704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan adware exploit spyware
- Windows security bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2