1bf174e675b6fb6185ada1a53d9b946c860429b2bbf25e262481df7818137e06

General

Target
1bf174e675b6fb6185ada1a53d9b946c860429b2bbf25e262481df7818137e06
Size 5.5MB
Sample260724-epcfea1wbz
SHA256 1bf174e675b6fb6185ada1a53d9b946c860429b2bbf25e262481df7818137e06
MD5 65ebc63d4e6b51cf20d66e036722e8cb
SHA1 c14322542c686d678b56fc91045f3bedf6199ecc
SHA512 c5a11e5f1c328e74746d827f89c0ea74f7d7d0ad21486ce2363c60cc759845226db961c3398e6487b4352cf863397e8c91182e1836e77761780a3b231f764448
SSDEEP 98304:32JeBsuACoyp1oV+LEpGcWOfENg5dff125IscPfO/7llb3aSpjU7sGrDUz7B5PAi:32BCbCV+sKSEEp92isc3y7ld3aSpj08p
TLSH
T1114633AD420B5564212244FBCF6909C10513CE3CE68EA48B77BCE1EB8D7EB5EC45BDA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setinst.2.0.63550023.msi
- Size 5.7MB
- SHA256 349f99599aaec4b64997585744605b91f03ef4aa3ad8284cfcd7731a7de2305e
- MD5 cfb33d80f7effce256bfe7367e8fac84
- SHA1 76065e1041f643acf685cb7f76fd5ee5d1b8ecc9
- SHA512 bac6820cef886ce9a3336f83335b5a1d4d63292af6080be57e7d5a89a7e91dad7625fb12557d416336429a179f2698acdbf0427e215857a0679ea49559a25244
- SSDEEP 98304:qmHoZYqAYoSZ585ElcDicWmDKNW/339E4cnhY7khI/tm7pDyGdnCXPdtjKgMObcf:qmZYty5Emu8KUnOFn9I/tm7HsXPdMdQq
- TLSH
  T1B25633D068CA2370D067C3F18656A67D711B7FD8FE639D0B7BB8B6140D7662849BA380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2