7705121da1a99249a912cef950f7af205d5d2fd331f1ffab79bf06d74188b40c

General

Target
7705121da1a99249a912cef950f7af205d5d2fd331f1ffab79bf06d74188b40c
Size 9.5MB
Sample260722-dhp79aaa56
SHA256 7705121da1a99249a912cef950f7af205d5d2fd331f1ffab79bf06d74188b40c
MD5 274bb91490d269ad9dd7f89698619fbf
SHA1 ea69bef3ab5eeb71e7094d334a653e5a5fd344ba
SHA512 c2820a9ef95082c5f2c05885f011e60d056ec032a740aa3fb5e3ee2904802ef7141c16e0321dc144dca9d1bdac98398fabe71b760c6e6e00634cf7d0b1c5a7db
SSDEEP 196608:YoSkx2XjIh+WMC0en/BOa3J8rpX3uWThOiUGqGvLM8mUWlv3ExmF6ZOa6sE2tdh2:SkTw4ZOa4pXTOPCrBWam6AsFvT6
TLSH
T16CA63390E86CA67DB1C8376E794875FDCF0FF84D069449D2A4DCCE6146E95B0B30A2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup.1.0.2286300021.msi
- Size 9.6MB
- SHA256 9d0af2d65f8030de57257c93020f9e53ef037099bf2b8851d1ccc71c54bef165
- MD5 8ba98be96bfcb3ba7b3a5d1114f19c44
- SHA1 6b038bc97e6174610fdc2be2a0033e65b6defcb5
- SHA512 4b501cb0cffacc35607c484dadcb10d90f147d64f6ad2cea03be377a8d06da3ce91f2fa33eab3d155c7472b01943c452909bae9e1ae1d33dd92ab11957c19dcc
- SSDEEP 196608:qI92DlIp+CK4ceVdZGeztvFAaL8H67158sIGN50y+w4D3HOX2RE7OA2gU237Zz:qI9aQZGez92a/4EVn4SWEWgftz
- TLSH
  T1DCA633C1F8896370E0CBE375590278FEBD1EBFC9B666484674E83A415BF26252376381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2