3883d511e764aa6bf45f88a3f210d682e995c034c9132cefd19372a7f286fcb0

General

Target
3883d511e764aa6bf45f88a3f210d682e995c034c9132cefd19372a7f286fcb0
Size 9.4MB
Sample260722-eyft7aydlf
SHA256 3883d511e764aa6bf45f88a3f210d682e995c034c9132cefd19372a7f286fcb0
MD5 411d709657cf9300b66ba4da99448304
SHA1 fb3e20546e534bce24ff8c6f3d9097140da47843
SHA512 7e9df294834fad66438bef51c12d99157e2dc26b7bd4dc06dc5d8fd42788cdbc56382b0bf78804b231676228d8b3988b5d8d7146ad1b5f908bb868b99c4b863c
SSDEEP 196608:X0GqZhH7NMi0aIciVPTU6i6IVdt4KV/RNmnpjjaXEv93DlQWO8o:pCbNfePTU6il54w5gPyWU
TLSH
T1BDA633C7631BCDB58EA5AAA9F844918C66981009A0D474D7BC6CE84F3EDF435A4237CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup.1.0.2286300022.msi
- Size 9.6MB
- SHA256 00a7709e88502a7eed6a6f216eb408d7920b51586e944b302d6144742fc3a55b
- MD5 74ff58273a26d716441a4692f69bd792
- SHA1 e89693161a0025b0f4310b985fa3ca3bf22c6c70
- SHA512 31c5d4d54902505c51a9cc7eecda28d703147bcd0b2c658ad4f80c9e0481bbabd1891ff1236fd28443d5cbe22478508d7101fb2e6511891f2699d8e5125729b8
- SSDEEP 196608:D97fWQE+Od8HVtHrksQOlNTwqT7X/mBTHjWbgX3OHlC2giy:DVfZDH7LksJbwAToDL2Y
- TLSH
  T18DA633D6794A5BB1D48BD3756102A26D71183FC8B8A58C17B9F8BE0C3E7663640B338D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2