b132bffa4e25e6c22bef8dff236cc39a6bb342d1b29a1e503efa63cc91759444

General

Target
b132bffa4e25e6c22bef8dff236cc39a6bb342d1b29a1e503efa63cc91759444
Size 7.6MB
Sample260728-3vls2a1vdt
SHA256 b132bffa4e25e6c22bef8dff236cc39a6bb342d1b29a1e503efa63cc91759444
MD5 271c3f6537d2a7b0fcbdb20c00a832ee
SHA1 5f459ad7c79eb4be1bb0378feae3882d6908dd8b
SHA512 2149740825fbbe1b948e0900174bcbbd13cb5d0d27fba728da78321cac0365fa874bfa153c2bff279eaf1740556251ad468d4d7c6cbee8429aa4c3f5dc9059f1
SSDEEP 196608:reiGfjMj9inlbKbCBBkv4KQenPPzQy1t0PPnXLUq4ycrRtYsIeLcdiUDZ:rdgjMwlbKbC/XKV8cm3nX8ycrMsIeLcZ
TLSH
T1F08633C3E991A0C9FDB1C0F88BA7E1F2C5D2C18E1C4E65D16DB094B21B8715D7CA9E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n001.msi
- Size 7.7MB
- SHA256 1f3ec54e2208f9d05c700a81e5a0e731997ded73ecb48fc118591fd2c4d8f388
- MD5 bc0b8d6e364fcef5fde59f4c360ab4e9
- SHA1 1d0c8eecfa490f6e4f2108d1fcd7081ce4037825
- SHA512 6870bf39ae9370b7e377110468a984b0af6b41181380ef6ce63590366de8c36b086cf3e4eec19c9fc4daec19fdca273f9945e2d286e8e29012bf881cd471c607
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWDa:nAGiNMwnbQvQTyhv92ALhve0ETWI8Khv
- TLSH
  T1A48633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2