87db482ec91fcc12bfa2e30ad5b5bd2cd307e10560364f87c6b2942eeb17edce

General

Target
87db482ec91fcc12bfa2e30ad5b5bd2cd307e10560364f87c6b2942eeb17edce
Size 5.5MB
Sample260727-mc8xvaz1ew
SHA256 87db482ec91fcc12bfa2e30ad5b5bd2cd307e10560364f87c6b2942eeb17edce
MD5 85c853d44f1bdf878b9619a033829028
SHA1 240cb71cea0cbeb3f071c826a2c0041d05de0ce2
SHA512 7cabce99802ac7dbe2977f672d06e8ba0d685c6db2a7b01ddde753e77bb58a7d3d42cf31ad94be58b6dc4621e43c27359abb0e461de43d4566c6f008e005c707
SSDEEP 98304:4Cytmy2wm4cbwB2DcL3D/JwXE9f8p6VSUYiRd/UcSBTbIO7rn:Vi53c0B2Q3BEE1VlY0dxcl3n
TLSH
T16A4633D3826EA46D8F43602A35B8037AFBA43CED0734E5BD9D69A91C507D7A7F40D188
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setupll.0.nn013.msi
- Size 5.6MB
- SHA256 7cc47120ed2d58f13fb17c04a53d2b4367a3e816e61109d7df830a0743b14222
- MD5 311df0e02e14ef3893d8955d42346949
- SHA1 0cb742c66d70080dcb8a73133317d9d47404447a
- SHA512 f782068e0992994307bcfcaa4668ebc864192c47d3555ff215b8da92dea720872a814e22efc525f82e2a2166307c82ea261c2e3dee5fea8ffb5f7abb8e6020de
- SSDEEP 98304:nmhaYPORt7KO2Zi/WcVQj+fyL3bjvwL0x7QzGVaiEiMc26Py2y0sJRbOotvH:nsPO3IoOc6j+K/LO01VJEiv26Pym6FpH
- TLSH
  T1675633D77CCE6635C453C3312166726EF22D3FC96F658C1ABA993E082D32726647A384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2