52aefaf78bf0956bca531f435cdabbcfc87ddf020772e614e882c7fbc537d02e

General

Target
52aefaf78bf0956bca531f435cdabbcfc87ddf020772e614e882c7fbc537d02e
Size 5.6MB
Sample260724-nr7trsdl7w
SHA256 52aefaf78bf0956bca531f435cdabbcfc87ddf020772e614e882c7fbc537d02e
MD5 65a2a3719f67a33630ee44d3cfde0ad8
SHA1 25c552fa338c37d39dd4e6f8e7968cfcdf3ad272
SHA512 54374cc1c29a77026210add37a060267782852d18fac4eea5afd05adb528fa3cbb69e780c4e49097f554e749e1acf9a0c978e9914c32356de33fc2017411c8d9
SSDEEP 98304:p0x1BClnkusiPcNYrIrw2ZcPkYFizIKsmji6bbpjK0v2/2WOEWJ8e/h2prZFulX0:p0xqCuXuYrIrwYyotjFprv2MDJb0dZFT
TLSH
T1AF4633491CA4264AE75CF50747EFB3D0032BA7206871E86331887E6D5C8A5EEC69C7DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intll.0.88018.msi
- Size 5.8MB
- SHA256 295f3fb092f86de80a7997ea6205dedaaa2725929498187fe286d95272872f1d
- MD5 bb8efa1563553a378e62d08aad843dc3
- SHA1 baa254667fc9b8f690b30d37cb8f1282954127b8
- SHA512 9218ecdc5f9b5cefca15de8ce6941c3a77ab1dbd0f03c031cbab3df752f8f4804142edae4f6dd2b482bcb71d9dbd399f2917e41feede07a2b6ff51855f27b5cf
- SSDEEP 98304:Z/viM5+G0lngqsKJqPu9orEgbE5UrMmkaBpFqIt92T4Sm+C1eel9Ep5LluvNWt:Z/aaYuqXSu9orEiwmFpRt928z1BgPLl/
- TLSH
  T1415633462CCA2734E05FC3B18696736E722E3FC49E36AC0735D43A1C0D7726A95B9789
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2