6a4de479bb3f94fd35e4c0fbd68033bf9744f22d16dea36f1d454e82ed6e7692

General

Target
6a4de479bb3f94fd35e4c0fbd68033bf9744f22d16dea36f1d454e82ed6e7692
Size 8.7MB
Sample260713-e328zsbz2l
SHA256 6a4de479bb3f94fd35e4c0fbd68033bf9744f22d16dea36f1d454e82ed6e7692
MD5 8f8328513a46ff626bee7aeec6b6c3df
SHA1 1f06bc92c45a0ff5b7a4e290558a725fc4ddffcb
SHA512 5e3db63bd6c7a1fa96939fd4715ad02f3a2c52d8433892efffc8fcebd8d90270e1991f271903835b3e4d1f3c0fda09be63e24da73d69f1abf925b28c80ae86c9
SSDEEP 196608:HJ5LsKcrk9TodK1tn1hRi2AcOXb9pfcou6nehUwnA3y78wV1:HXLs7k9w4lNicOxpRsey7l1
TLSH
T1AA9633DD9FD273A92FC267FB5BCAA208C0816AE848014223F7F166C5B6931476DB05F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.6653009.msi
- Size 8.9MB
- SHA256 9acd57938b29cf159cc90566a93766910caa90f51a157163412de906d044c4d1
- MD5 fb2afcffbe945edadf7f05d69b39f577
- SHA1 5d1640ffc26bb064bd0bad03be7f036d4d71153d
- SHA512 26d60180b8e2817f333e9389a9d44c4257f181235bf99b9f55ab6ed919a01c73ca3bd3c8122a3f508078be486548fcc1a7ba15b99f309fa53ce79eb5102cdeba
- SSDEEP 196608:NxKoFcThmRsLs+US8U91XdTas8Yd0NewVwjax+Qrq:Nx9cT+dq8U7p/q0axNq
- TLSH
  T14096339BBEC32375D8C6D7F5868B626DB0653FD08C204A13B7E9764D6F7312958B02A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2