3df9338c9ee048480667998b0529f25fbbbeb9b829bf1aff3530164e3f855b79

General

Target
3df9338c9ee048480667998b0529f25fbbbeb9b829bf1aff3530164e3f855b79
Size 7.6MB
Sample260728-ltwheafn3x
SHA256 3df9338c9ee048480667998b0529f25fbbbeb9b829bf1aff3530164e3f855b79
MD5 7b742c75c4442c833d89f0326e3f5c34
SHA1 61b1a503ec7405d88a3f4ecff4b44ebdf30d69c4
SHA512 13e961e664242ad9b62de642b71a78556cd3dfe0b5f4d4268de27a6281ed45d028fd0578ee783691bc98de08d15fd67a8333e716fc371e1973e08d2233d9e328
SSDEEP 196608:FD+78zi146FHR4hHUDRGb958LnBJPtSW/t7:FD5ipR4h0DkUXPtv
TLSH
T14F8633D92C99F3E27F9969B402B6C4C5C52634031DA9FD0B8A1890D4DE26E0D5FCB2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_966r30014.msi
- Size 7.7MB
- SHA256 cc2a5bda1f718ce0dc97e81dd9118ea9f0ae13be64345852f2e0f5a710a17518
- MD5 187c6a5a9d8594d61c0eb5ff0b489dad
- SHA1 b200c4135dd4f823665cc9b6abc0c6650d63d40d
- SHA512 9b0feedbcf790cc0ec82fbe9cb9c8368b40754afc6daf9eb42ac4db724cb910215f0bc9fbd0080ec883391c3623a96abb1327c11eaada0d96fa3729dc195e594
- SSDEEP 196608:x+b6VoPKiXflNXSPb59Rg1dHklfTjJrGQbt1:xzoVf/SPV9CG/Jrb
- TLSH
  T1148633C63CCA37B1D087C7F04153A09EB12A3FC27E669D0B6BD875444E32A1959B739A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2