0d0df8729ede11252a8f02ee73d41916701e1ecd42b83c88369a5cacdfe71105

General

Target
0d0df8729ede11252a8f02ee73d41916701e1ecd42b83c88369a5cacdfe71105
Size 5.8MB
Sample260717-dfhemahz8m
SHA256 0d0df8729ede11252a8f02ee73d41916701e1ecd42b83c88369a5cacdfe71105
MD5 66832d87cebdc100f195cb669005d8c5
SHA1 13402736856e8e4b304761bcc3b93cfb0d911ac4
SHA512 e23fe8c198355fd0c43c8f0ea6ea2ee0bd7f71a48f3b0c51ca4c66481bc02696d270996cc860772d35b66a0af33e0fbd812d33d9b4786a53e16e2b8f070a3d90
SSDEEP 98304:T+o63IlYW0S23V8q/BM6dm/6v+eIja0MzD3P0JEHkaLoXSBTF05D:T9y6SV8qJ8/6vrcJa/ISBRID
TLSH
T19E5633B682757DC6E6BFF3D0FB26240341091F98054B9E66B5DAB39A6A3DCFE3610500
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intall_app.66553011.msi
- Size 5.9MB
- SHA256 3a904bb9262a0d63ec457ff0f537525efd87fd71929c994c9776905ba50198e5
- MD5 2edd55c786a4adb0d833041468ea3337
- SHA1 f81af7ef694323ae855c6dd39ca947073de90f91
- SHA512 1140779d18f93abc0a2a22e70e103ec941818673f1fd92b40851997b201df7716104fe35405148cdfd73cc5d5c524259fc91357da56cdd51e3e8a2f9f6e01586
- SSDEEP 98304:g+FBnAq0suNx6uPLWo9m/anMBSM5jjA6NAdBEhMHwcTC5IB7hGvR:g4qx6ujQ/qM5jjARAhyreIBteR
- TLSH
  T141563396F48B69B6D02BDBB4671B711FB12E3FD54E228C2BB5DA725D0E335292834340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2