493b330ae4993d9d2f4650821dca781adc4ed6efc6044bef8b73de1783f77b3b

General

Target
493b330ae4993d9d2f4650821dca781adc4ed6efc6044bef8b73de1783f77b3b
Size 5.7MB
Sample260728-p5aa4axblc
SHA256 493b330ae4993d9d2f4650821dca781adc4ed6efc6044bef8b73de1783f77b3b
MD5 faec7d7e41fa9b8bbbb345aa8c2502bd
SHA1 e2d699736d91e438f590d6b76c6d2caea36037a2
SHA512 d0f223b51141c9b05142f63fd4693ae4e95420b38e8328a17929941537c40412ef27c306e8e4888dedc097128a5a7769d15b7d6fd5e98e45d57411dcd136d9c6
SSDEEP 98304:LU7qqp0KUTaKpnsKnu5XsRZviYRkwrbx+0tSsQbS78b8TkGvPMTkK:GqM0KcDpn9csni2kwrbxfSHSgiEJ
TLSH
T16A563356503C3E908689CD2A4BCA4FC7B07EDC76B89DE5DE0544EA072BB9788AD0DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n020.msi
- Size 5.8MB
- SHA256 38587c30754ee0f0873927378a7ed2dd54c28f93ae1e7aec0629b0ea02aa29f9
- MD5 d5bf4103378afe8b9b855302553d6a22
- SHA1 eb2b8c7e378935f8a9ed4524b1e1ac0ab1277e7e
- SHA512 f6d053d010872045b617e41010fc28065b4197b3224a47ba4c9aa85b0954a056ac537b0221ec92a97c4f612caa0e948b12d76a0f1a87b3f538dcda3d8c5aaac0
- SSDEEP 98304:lNq4L6KU5auvV4sZM5ZaJlUFl0zsC0xP0SzuRDGB2iVQ0tM6hxWXwLaJkY/tkjkL:fqG6KeVvVpAanUD0zsC0xsSyFtKVMm0D
- TLSH
  T1B35633C6B8CD3770C08BC7728292669E703E7FC17E3A9D5776D87A091EB16149A7A340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2