94923d4dfb26fb9f228d380670e1a0cba7dfe54c5d2e5162aa77ae2cf11e4481

General

Target
94923d4dfb26fb9f228d380670e1a0cba7dfe54c5d2e5162aa77ae2cf11e4481
Size 7.6MB
Sample260728-1rqlpsca57
SHA256 94923d4dfb26fb9f228d380670e1a0cba7dfe54c5d2e5162aa77ae2cf11e4481
MD5 3d0f7ba480565c9999d5d8a3b91ce3c3
SHA1 9b2acc0f173a83154720f531afe7c687da61a12a
SHA512 4fcc4e39f0c868d8cd9ced0d40bf43eddc47d9beea4ed2099904f2094b58fc338f3881cae6fc1420602bbaa0ef79b9c3af3d11162f9d87140cc295f3e185e5e6
SSDEEP 196608:WeiGfjMj9inlbKbCBBkv4KQenPPzQy1t0PPnXLUq4ycrRtYsIeLcdiUD/:WdgjMwlbKbC/XKV8cm3nX8ycrMsIeLc/
TLSH
T16F8633C3E991A0C9FDB2C0F88BA7E1F1C5D2C18E1C4E65D16DB094B11B8715D7CA9E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n001.msi
- Size 7.7MB
- SHA256 2cdfae6b0d8662a5b45f8ea6b442cd84f39c954794e75d30c13e4ced3594c72b
- MD5 de9a527c7b5f747b87ae6bbd82387fa0
- SHA1 caf65d3051eb253bad6f5972c36ca96c91df2ef5
- SHA512 4c49470e01584889abb7ea56d8312fc6b28d4f81e210fac2245c59d61eed8ec4cdff1348109bf834be2cc992d6344f3c0587bb0a880c231f016f6ea8744c0c1a
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWDj:nAGiNMwnbQvQTyhv92ALhve0ETWI8Kha
- TLSH
  T1008633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2