c2f6e4df4781c477e7fbc7d4b319c6717955e3af6053970f86093c1262788492

General

Target
c2f6e4df4781c477e7fbc7d4b319c6717955e3af6053970f86093c1262788492
Size 7.9MB
Sample260727-dwc5vavdqc
SHA256 c2f6e4df4781c477e7fbc7d4b319c6717955e3af6053970f86093c1262788492
MD5 bff8cd5898e685b9673e63741fc23808
SHA1 9682cf12452305133caec2feef2a35aa75cfc585
SHA512 8493a67b5ae306530826cd0f7167473813e15662f8bc98c38523bbac3c4b6003e04f6cf0316f3d1108078b7d1cb733d498ab68f783932abeb0f1b52f74d5eb23
SSDEEP 196608:hipp8Sdw+WH4RWB1YIpkMLrTfLeq52s295WcQ9WApqrw+SL+jMTpa:hipp8Sju4qY7mrnCV5WPqrZSL+jMta
TLSH
T1F18633D24D4A1AB0E3C5B461C9EA2ECE7D1FB6C8DABCD9D6C3253014B52712D0A6163F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setupll.0.ns001.msi
- Size 8.0MB
- SHA256 7f41fb5e1db217663109bded4c0b49610df0a754824e76df2b738c267543583e
- MD5 5163924f4ca15ec41d4a39cdeda9f530
- SHA1 b8a5425298f2b18460b0b8934b15516ac70dadfd
- SHA512 9b35e9f195092c31e4778c9301dc72489b65c42ebda52197fa558bf4a925e357a0ac8496a7c18b24e08ce1602efa77d41dc70b87275c9394d5f6bcdf757fce39
- SSDEEP 196608:Si9ILz4OzQawOjoGq0QR9D04etng21ysC71y8S9oyv2FsuuHgzcJbl:Si9ILz4OBsR2NiV1y32FzuHgzc5l
- TLSH
  T11C8633C57DC92770C2CBD3B0C1D2249D3D2E7FC5FAB68C5AA7A535006A33629467236A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2