ee128fe98768a6e97ebbffdb97b4ed79d0b631c50fd02a9d3e6f76013ce60ea9

General

Target
ainstall-setup63tt0012.zip
Size 5.8MB
Sample260709-ahxesabx7x
SHA256 ee128fe98768a6e97ebbffdb97b4ed79d0b631c50fd02a9d3e6f76013ce60ea9
MD5 fe23016e48942ba8c221d9c4f20511ae
SHA1 e171e2fff5b950e5d3f5de57e35a4710bb990f3f
SHA512 e96ed3b47822f231aaa067e3ab3e78956600e75f719bd634718966ff148a0b726fee1b084bbdccfb330bff07a5133c2f2dbbacc45876646c2b03f642bb526c4d
SSDEEP 98304:XsLeapLpy1eadcjXhof9e/vs+psB/0FWOXSEYgN6gHkkcYxG6g9EhqDeEV:XDs9QeNXhI9e/3WceEY66UcYUZ9EhqD9
TLSH
T19A5633EBBCCA6351B20E909B26D181526087E3298DDD91F0CB453DDC7793F424A6AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ainstall-setup63tt0012.msi
- Size 6.0MB
- SHA256 b1b586b20083208212a9b083e8afd97ce32651703447c6f54c2317857782bce2
- MD5 dd97aa6a1522b6ac55369d2b8aad8823
- SHA1 9616ba6b1f2311bf60e8a05359bb7821fbf4f119
- SHA512 44fef2fa6124c6360efc97809f30fe0cba914f1b7ef7c1f190626d63f26e249f2f72cdf9eabfc612f4c8991f3469385bd1e9df41830270308c1cff3cb1c65ba0
- SSDEEP 98304:RhiLCcNx7kXcWhcbXhw7ZAnPOn8nSx1EiQ90nh5PfS2974kJ5OBeEounwce1Eb6L:jJWZ+cHXh8ZAnQ46YuDPKoMg5aouwj1x
- TLSH
  T1705633DAB8CA2931C04BC3B54693606E312EBFC49D6ACC46ABDD3A4C5F737124976709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2