b45631f355d5632a215951015045e98366df5a3f8d8bcb41412c32b3926f5f36

General

Target
intall_app.66553010.zip
Size 9.5MB
Sample260717-pg1s5set5t
SHA256 b45631f355d5632a215951015045e98366df5a3f8d8bcb41412c32b3926f5f36
MD5 595f9c915df064a8d916a9d4ab269f47
SHA1 4df1491fb4407947eecb3cbda1d1328f1d2fdea5
SHA512 5582c1ae51d8ffdbc7f2389fc34a10a6bd14eb4da0aa0564a291b59080239ca44bc20030aac6534a15a72540e3b76cbe288279e3db93f90d57e5f993ab30e080
SSDEEP 196608:tfWas8oFZJy08pcswRvIIFAkYahOhOXQ+ekE305Q2ue3pubK:tfWRFby1cFRlfYaOhkQrkE3SJpt
TLSH
T16DA633F532A08F1B7604A60EA4C0DFEEB44EAA55F5AE1354D5AE2EE0E44B7D0340DD78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intall_app.66553010.msi
- Size 9.6MB
- SHA256 bad1bcd47849cbbf8fcf30cb255ddb5a2d9f05783e3376cc5a938daf49d62796
- MD5 74aa0e5f83128af6da9e7830b2d6e128
- SHA1 55f7d2bb9db6eacd24584c4c605380851e783ea7
- SHA512 cfde2ea9f43e7fe546c291e646c4b8bd6d33fc2477892879b94f8796307044a3b339c590aab96525eff73717766bdd2d77b12d853c385e6556a6615dda0b983e
- SSDEEP 196608:fbWUkwQHVfYrz/MS98s2k7Obu/mk4kUb+/q6YCF3u3o:DsRHVg71f2gObOmLkUbMJ39
- TLSH
  T12DA633D5BDD14A31D007C77891C2AAEEB01D3FC4BE7E5A027AD93B40CD72696207A798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2