69117cc739fdc84d4bdd60dddbfc286df17500d0232611c2901125327ea5cc1c

General

Target
69117cc739fdc84d4bdd60dddbfc286df17500d0232611c2901125327ea5cc1c
Size 8.4MB
Sample260728-s9xtqsaa66
SHA256 69117cc739fdc84d4bdd60dddbfc286df17500d0232611c2901125327ea5cc1c
MD5 5c3f0567b8b488df5b900d4791643af5
SHA1 ecda4a0f083b5daaa4246ee98ae5284c6026f956
SHA512 e2345a0601640dc8ff8c5dc03d996fd00038211a37d24afeee0a98d0f4bd2161f52c8254b13f3fbaba411ac743cdf2fd204d975593f2076bc277a92bb8268278
SSDEEP 196608:wnQcITBxFQvv7QsvrVwQGL34v/5iseFNwpMcCTGbq:wQcITHuvRGL34354FNSCKW
TLSH
T13196336479331AC0FC444EA035D03FCE39995A4D7FED97663C322A17EDFB922588A162
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n005.msi
- Size 8.6MB
- SHA256 d814957e2c094400bc383a663d6b1c274998695ceaffeefb486b0b5fcfbf75d3
- MD5 6ce1f529d337f08b23e033e2ce348841
- SHA1 3e9bb96ff1c249732796fc03fff9c4743894d4f4
- SHA512 2b1a04c7acac54fba2a0282e196778fed468d8bade7314ced98fb3a0782a823d71f5c4008559f9f958a110fae138d5269dbe5e4ea8f73a6fed8e6c1b80b3f567
- SSDEEP 196608:ecvbXTrC1VQPZ6TExui23O2dpQtTf2WkX39bwdHaEYbGpO:VvbDO1qPblYdpQ5fWX39UdrYCs
- TLSH
  T14F963358398B27B4E447C7B062427A8DB21C3FC68FB44E1639ED3B4D5DB36228DB6251
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2