e6b17f8d59d5e86a27c75da2addd5aae85bdcf37ece0ac3b0774da2980342ba1

General

Target
e6b17f8d59d5e86a27c75da2addd5aae85bdcf37ece0ac3b0774da2980342ba1
Size 7.5MB
Sample260728-vb858aac93
SHA256 e6b17f8d59d5e86a27c75da2addd5aae85bdcf37ece0ac3b0774da2980342ba1
MD5 1bb92b01aad53fe8fe622e3827cff173
SHA1 14aa34c393ab82ed8509b638a3be56da935ddc94
SHA512 4d6f2c9639cc280330f7ff0d65a254ca722adddfe5b6a14c4382901f40a177be00ee51f7a0ee8a155dd8105b8229183b2bff449bf07368369742d58f7c6cc6fa
SSDEEP 196608:rsaV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpYC:g1RCqd5v+0CS0AkKr
TLSH
T1848633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 96a7d0f51c69d3c392f668be28df4569a5a6f17ce906f18450487c22b2f9e4a0
- MD5 0588019453b45d231c034107937c19af
- SHA1 82c6fef26c7c512a59be0c52816757805d8be3cc
- SHA512 09fcb583ba790a473f4c62a6fce4fb5510ebffe1a6c7f45e9430b95beadec90f0ce2580dcb5fde8874d758517ccd6de93252bf512d8660151f1deb259e526b77
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgU:xGSJty8TaCyLA+Ckyn
- TLSH
  T1C9863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2