bd441aad004b40bd7ebb76cfdd3e2e367e2635f00a107c184ccb62ae1ae7eb96

General

Target
bd441aad004b40bd7ebb76cfdd3e2e367e2635f00a107c184ccb62ae1ae7eb96
Size 5.6MB
Sample260724-eq7myaed49
SHA256 bd441aad004b40bd7ebb76cfdd3e2e367e2635f00a107c184ccb62ae1ae7eb96
MD5 41c5fd11dd9fe62bea0b6f791589d2ad
SHA1 847c0e991421f689f0446542434038123274fc7f
SHA512 53851bb78a49c2be0ceb581d95116fea6398a41f1de4f304747ecac59ef6ee3d086844892f45f0b3347f008b3efdde4610c480a4d0842ba4b3d9d6b57dedb711
SSDEEP 98304:OMZFK90x6umVjqG8hzEMG5riiZvdSzYWSkAPtvJo783r2doozHw2gnigIK4kBzR:vr80x3mJ8TmfvdkPSjtJoA3rstQninsX
TLSH
T1AD5633DAC6C2FAC4A5D81FF5038B7B03A18B065B2B4394379A5F367E7B7598C210C994
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setinst.2.0.63tt0023.msi
- Size 5.8MB
- SHA256 713f5d52a61e354c65bfa9ca139701c198f8d0a79416ae3e1b4699bef363d664
- MD5 74e71a893f28843d4749b67a86ff939c
- SHA1 9096a1915750e4285c3dc22b3f7bdc45607b9fa2
- SHA512 b6460d69f67fc04d731607e000f547f01e661e0dc709c60d091473d1ea63f0b7a76fd329404a0664cc9d72a183caec2d63549fb7b5ccda437202c4a84eeb0c96
- SSDEEP 98304:iNLpXZZWEkybLYC1HqsKdvG6e/vWitOxm43lato//qkKEw3neuNSHbUdkc/XQOuz:iVppZWabsiKfE/OxLEalqeuMHbyp6ry2
- TLSH
  T1465633C6B8C663B4E497D3F0838239AE712C3FC62F658D227A8D3B1C2E31A1A5575745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2