eeb6cca106594f5680548d2bb02c980f00e9ca3da5ee28369f868e7795a9e177

General

Target
eeb6cca106594f5680548d2bb02c980f00e9ca3da5ee28369f868e7795a9e177
Size 5.2MB
Sample260719-d76arsdy4w
SHA256 eeb6cca106594f5680548d2bb02c980f00e9ca3da5ee28369f868e7795a9e177
MD5 ddb9751a509524102f910c13d361c24a
SHA1 3c370f8549dbc0b5901cb2fa80f8dd72d51f49e5
SHA512 dafebb971b3851abbe8a40a9723e93e1d67fccf3ae5ceefc395a34dbe649bb73ab9e469b241ca16fa7476dc64600358e728fd21838a5226717b09b03a24c0684
SSDEEP 98304:zDwwJg++fulF6z2YwcGg6aAPjiRAI2ZkpH2IxLaSk+HJCMOPSb3WoRJsWnw5W4Xf:fwwJ2fuD6z2YJGRTFvk9BdVkKmoRyWwd
TLSH
T1DD463343D3FC19E8F487A3E20CB0A8BD8D623FD50C6E35A9895666736A432F17646C53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  installer.8332566018.msi
- Size 5.4MB
- SHA256 c0760133416956710e12a4a5a9ef34440ce5192be039ce782b35c5598aa00c68
- MD5 8a85fbdb6b5470e2f8f81524743e53bc
- SHA1 878608506b3db1f6cf8d820bb52e24423af29697
- SHA512 c507ad4be95d1458e3960ee27540bcdd7074ee6dfc3a8e742ab28d165528c43c86650e3172ba1654219f82e528c9ece5681a8a4a64d9553f5c80a46bf5bfed45
- SSDEEP 98304:SX43N6JMkwMGmE+cFX2vWeMSOQrPmX/YK+JSt3IIJBq45q/4yXBfe:SX496JMkzGhHLeMPQrPmPh2w4IJU4QLs
- TLSH
  T1494633C2F9C913B9D08BC3B1449238BD7C3A7FC5BD26AC2B7A9937025E727265635241
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2