f707c50e9d9a40834d13daeb97cc5bc6ebb40e69dd1297e21344681c66f649ab

General

Target
f707c50e9d9a40834d13daeb97cc5bc6ebb40e69dd1297e21344681c66f649ab
Size 9.8MB
Sample260723-pcd4kswtcy
SHA256 f707c50e9d9a40834d13daeb97cc5bc6ebb40e69dd1297e21344681c66f649ab
MD5 eec3a602245b5686cf3576121183a4ce
SHA1 10e843b4522203e9ff44bace4a9b080fd0592cf3
SHA512 b4fd66b6c6528f91d003f5c49812c7609d876d17cf545f68c2a7a618eeb4a0e8a07911e757ea17b82fcad853b0385b2402002b59652b374c411a601832e285e4
SSDEEP 196608:c5vcvGY+7fNIqISTunHOue/ciDT8smyUYaoOB7d8EsE3zYrZvzu8RPEnJDr9V+q:4vc+r3IbHO/T8RUaVH2u8RPsJDrrP
TLSH
T19AA63359C93F7D68CE33293E2B2D2EF2143B8C3194A504285B5E667185319DF682FF29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup.1.0.2286300014.msi
- Size 9.9MB
- SHA256 1a78327cd7851aee3e8725c158ac3a9cc9690b5ef6e5d9ffb0889144573ae84d
- MD5 06e6a2cbe4581f4bad230f741bc88f5b
- SHA1 f9d4471803f13601b1bbd2df2e91899695265cf0
- SHA512 0840a9a04346474a9cc27e01a9b3a78d4598753613fb9497c30a562cb7e59ced36433dec2ae47ec06c9c5353b9f80e7f351374bcf50d4d9f5b4f3cb7a4d97470
- SSDEEP 196608:iF9Jv/XMoUc/GDtUG5bqmIHWkW0CoCF3RwW+aPNMHfnvcDHhYFf9rxpoq:i/FPU3txdNI2UCNz+cDHh+f9rnJ
- TLSH
  T10EA63388ACCE3A74C517CB7D562631FD383A2FE6B9714C297AAE37101932326253B754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2