a01fe922022871cdfd413bf30d764ed4b4a8a438809cdcaba48e74c339a535c3

General

Target
a01fe922022871cdfd413bf30d764ed4b4a8a438809cdcaba48e74c339a535c3
Size 7.7MB
Sample260724-pl98daej9s
SHA256 a01fe922022871cdfd413bf30d764ed4b4a8a438809cdcaba48e74c339a535c3
MD5 337fb2f75d199024bc5922aa9ed3890d
SHA1 c67249ff8e1e4db90b09887802655b3160582ca9
SHA512 d4829972de448ae5d7407c8c40ef3afbd42913780cb0ccac7d24d410792658bb27f0599616352055597a1c09fddc5d737e8e9d707a4badd2ccd781f9ac781159
SSDEEP 196608:ZU0EZvGNNafBKU8BEs0IgUCcHmirbzRuD8OpCQ:ZxB6fBKBr0IgUhGirbd6VpL
TLSH
T13B86334D5FC9E8D06ED6904DF71027244EEC9444E139820922B270976B68EDFFB29E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intll.0.88020.msi
- Size 7.8MB
- SHA256 7ff196b470e276c3443ecc580392419c04437160d64770123e29c6b157c4b904
- MD5 86f90bb12f6a5efe2e6f8744e2849144
- SHA1 f25bbe9e61d140827acdc0169849a72e7e2ac5ab
- SHA512 694dd3a836e485179d35814fbb36bcebf3ee2adeaeb0e65f8a10d70a43434f9bcaaed1afa14659c539467e79336ec5e57597f70e0d96f9ace329a43b65d28b0f
- SSDEEP 196608:l1x0mI1VyNra3fapU7jIFIsGCDSirx7XcLsYhKe:l1xphs3fapUjIFIs5+irxTuVh1
- TLSH
  T11F8633CD7EC97BB0D1C7C374E2427A2C7D197F84B6368D0A369478415E32B2A1336A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2