437b0821ae70f6b4a8841ff53efc23e3373ca33ea7d2cf2202aeedfb684ac37c

General

Target
437b0821ae70f6b4a8841ff53efc23e3373ca33ea7d2cf2202aeedfb684ac37c
Size 4.9MB
Sample260728-m2tjfsvdmd
SHA256 437b0821ae70f6b4a8841ff53efc23e3373ca33ea7d2cf2202aeedfb684ac37c
MD5 d58bb4534727bf70c935d49ddfeeeb95
SHA1 aa90cb73ed7700e05c0a34ffafa7b8a63a1da461
SHA512 4fcb936a54b0464699d37d6d27c745eab79232c1dd0d24e755014f2936486a4e807dfca28e67522ba4aa6c8765ca3c218ef8b37e54b6dd672145e96695330016
SSDEEP 98304:vgzStnFla4KF6Gk9HvqE780JoM71r1nNXHziGnI2JaUJAWeG:IoFEJaC0/oW1HOUJAW1
TLSH
T172363338E0FD58E17EC848FA7D2CB3D79CC130418C93A15EE673566A85E816B928E53D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_1.0.115.msi
- Size 5.1MB
- SHA256 b70412a2c2ac7749fbb2b2a5b31db317bad517f9ed6ed0edd0a92aec4a17f874
- MD5 979342bee4004be90501ac3cbd83542c
- SHA1 69f654d60f0db2b82ec66f8070f061aa9a310e47
- SHA512 bec79de8ebe8e13a879c5f17d443ed3b1b85793232d878988a5410b9d4af8a9c3feaee2dd5dda1656db244cfbbb92334153aa4812d2cc1bcd99b123be8735316
- SSDEEP 98304:5hMtNBaSSnmGm9RF8EhwSwaeSY5g+oWu0R8vL4WewqJ40JCcq:5hMne9SGI8ZSY5g+f7R8vl0JCc
- TLSH
  T1234633D9B4C937B0D5CBC7B6590632AE78163FC17EB38C07BAE936044D7161A22B9748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2