1b04e4223554bcef55ea8b915eb985997e025c2c35ea835f9b9fab9adfbaba71

General

Target
1b04e4223554bcef55ea8b915eb985997e025c2c35ea835f9b9fab9adfbaba71
Size 8.8MB
Sample260728-ltw4yatzdx
SHA256 1b04e4223554bcef55ea8b915eb985997e025c2c35ea835f9b9fab9adfbaba71
MD5 13d205cfcf2f7b24e2281843b1b6977c
SHA1 44b248b1f6d88f709b00c2d27d5843b77fc51d21
SHA512 42e671e0b7a9b496888e46d29b758979101321c32034e354044c94e07c7a6bb44f1b52848004d5eafeb5b210e1a0704ea63596ef9e19d94e742ae48996fdcbbb
SSDEEP 196608:2g77GlpgHxhq4i0fMplOQKkluLLu1j6AaDdreu:HergH3q4i0fMfPlu2Adreu
TLSH
T15A96336658098A4DFB7B6CC5FAD082F74A33E5200D06F2CF1B1F657A046B91682BF15E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_966r30010.msi
- Size 9.0MB
- SHA256 394a1b0fc774d5c22dee9d2668ad3249a8e15b7f1b68f2401d911cc4bb2366a8
- MD5 e6063b80b9149456cb560c393432b8ea
- SHA1 7bf41ca4646ab6befdc5da80c1ff00b1fbc84380
- SHA512 2ea3e6386106602c9a8572de37600770f2ecf2e9829151ff45f652a8976cec4115cb0fdcedd8d9a8eeeb5c0382d5009c4937d16b0ed9a233acaaffdbec595513
- SSDEEP 196608:iw27JNURVCR/h0OI+XDbcIXnpKc+VSr/W1P2EExFtkX:jzCRZ0OI+Xtn85Si8FtkX
- TLSH
  T1CF9633957C8A5B39E187CBF0A591A0AE7D2A3FD13E128C0B3B4B72590D7722543B7349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2