18b52f0af4ac6c9d1b9c4d0a219978282a783f3c52632d9c5c27835b543d6695

General

Target
18b52f0af4ac6c9d1b9c4d0a219978282a783f3c52632d9c5c27835b543d6695
Size 7.6MB
Sample260728-1tm9csam4y
SHA256 18b52f0af4ac6c9d1b9c4d0a219978282a783f3c52632d9c5c27835b543d6695
MD5 df40e71e03255e21724d7cf56f98be46
SHA1 4ae26e3ab585e586121ffbfaf9dab2fe0b338688
SHA512 57c2f4d6b40aaefd7858fd624e6090d695506e2c3b70caa33bb449b5b624346185493d5018e0db5a66d3eb1be83ae897caa680901bd3f4e88e6afeec31575908
SSDEEP 196608:AeiGfjMj9inlbKbCBBkv4KQenPPzQy1t0PPnXLUq4ycrRtYsIeLcdiUDy:AdgjMwlbKbC/XKV8cm3nX8ycrMsIeLcy
TLSH
T1CC8633C3E991A0C9FDB1C0F88BA7E1F2C5D2C18E1C4E65D16DB094B21B8715D7CA9E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n001.msi
- Size 7.7MB
- SHA256 9aa02bda20fbb8662a035827223c2cdec6c36aee2b2c072f7ab87f6e414a7a99
- MD5 6a0d5d88b1baa6b06e1fabf58fa86919
- SHA1 4985c19f73532f1829f3c643a973ee9ca7291490
- SHA512 8c4cbfb9f5eed0ac07c87ba3aa414afd4221f9108bb964382bf8c58b6c5b2685b2c498636541d1be1885e66c9193104d4a8580ec91b74f4341956facdae13ce2
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWDb:nAGiNMwnbQvQTyhv92ALhve0ETWI8Khi
- TLSH
  T1818633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2