89657541f11fb9a60b1a35c2efaadf54838bdfa49dff74a09b9abe872b973704

General

Target
89657541f11fb9a60b1a35c2efaadf54838bdfa49dff74a09b9abe872b973704
Size 5.9MB
Sample260711-lmgexafv4j
SHA256 89657541f11fb9a60b1a35c2efaadf54838bdfa49dff74a09b9abe872b973704
MD5 750075f2a855df57ef77ee9128675f75
SHA1 94907ff5ab158070a1acd422c46360f445612d13
SHA512 b5e780782b7acf4f6dbf1d15fea253e85ca26899fc91b414d6d25a01ca94cc0368280f873523a56fd2f193769710763f83037416fb58be471bf8c4d79b32a1f6
SSDEEP 98304:XpXkXNax0u95NGiqlkf7Ztd6+AVkDbzsJ+BV8XvRX1JTjm4mgvuZiYr6N9fRqgKu:5UXNMj95NvqGzZjPJDPsJ+78XvF1Jvmy
TLSH
T1775633477CD114B5AD03181399F480C798CAABFB8DB6A8316ADC4517FBEAC32DE416D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intsoft.1036tt011.msi
- Size 6.0MB
- SHA256 2546a2040e77a9efa23e21cd6b4d82a966495a15d43c97dc8eba5843fbb01408
- MD5 6c464e7244ad9440f1eb76863026a653
- SHA1 c5aaa402c56f28d48fd65ac8c5331f8982da4c36
- SHA512 056b72f3ca723db6cf8c935279775f4bedff3436f9a1a1bfc801b06d899c1191b9eb3370819fce86912c5b6ead0643008268cd63a299f83da38efa4788d02b63
- SSDEEP 196608:cpfS8rcRq2pRp/lXZoHmgWD/mXXyr0Dnka:cpS8rcRqurHoHiEiAj
- TLSH
  T1F7563383BAC649B4C00BCFB1986A619E706D7FD78E718C2239D97A1D5E73C205EB5780
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2