31caa36ab289aee617616dcb7c7707f3dc292a959375b346c6832927a18c8ecd

General

Target
31caa36ab289aee617616dcb7c7707f3dc292a959375b346c6832927a18c8ecd
Size 8.4MB
Sample260728-s9xtqsaa67
SHA256 31caa36ab289aee617616dcb7c7707f3dc292a959375b346c6832927a18c8ecd
MD5 a7f001f4943c0bf37cfb6abc58e23827
SHA1 4932bc1d0488c9a94ea232412fa30e8aefa4884c
SHA512 131c4b1a83eedd153aa49aa8a3d3fbc9b5b07064d259dd4903a4412d8b3281f1452f9b94400e8b6f503127b5abb55906e8daab912887dbe0bb37e11af14cf759
SSDEEP 196608:8nQcITBxFQvv7QsvrVwQGL34v/5iseFNwpMcCTGbn:8QcITHuvRGL34354FNSCKb
TLSH
T13C96336479331AC1FC484FA075D03FCE39995A4E7FED97663C322917EDEB522588A022
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n005.msi
- Size 8.6MB
- SHA256 8bcb26bb8eb74d664adaf201b90d4604cec651843d5cb9476ed046b1eab29d3e
- MD5 244e708d2a3b00c087834ef0f11c5f78
- SHA1 2820251e2ca30852499c56fb8c3701785ce54903
- SHA512 bd8396a7755aac97fb7c897e89ca42576ca3e3ca6b56d542bf8ef7efe282daf01b97e81449ca31815f0aa2323f19749fdd21f9409392ec5d0e6a3ba549d2d078
- SSDEEP 196608:ecvbXTrC1VQPZ6TExui23O2dpQtTf2WkX39bwdHaEYbGpj:VvbDO1qPblYdpQ5fWX39UdrYCB
- TLSH
  T14B963358398B27B4E447C7B062427A8DB21C3FC68FB44E1639ED3B4D5DB36228DB6251
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2