cea306b94852fca796c745f90158fb9af7a874cafd39d0e8bf6b71b2d5e5f873

General

Target
cea306b94852fca796c745f90158fb9af7a874cafd39d0e8bf6b71b2d5e5f873
Size 7.5MB
Sample260728-vb8vfsac92
SHA256 cea306b94852fca796c745f90158fb9af7a874cafd39d0e8bf6b71b2d5e5f873
MD5 14c9b89f5c34942b46eb498d63d44c15
SHA1 473c89ee0d60e59e28a775d6068503300e4088f1
SHA512 715c94a8faecbb89c76b9ea1115cceeed28e25e2612b6afb58f76938c29186a92dac34181ce0341863c9ae76c8c33b39da0c0e9e89218e6e5070eaa0ea6ca704
SSDEEP 196608:OsaV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpYH:R1RCqd5v+0CS0AkKC
TLSH
T1848633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 2a6886c29be824a8b7f83c6e4d4abafffcc356782e0b53cf04d03b01868af2cd
- MD5 1eb454e8284294c74ffa87b35be4e731
- SHA1 1044ad3c3f44cd1aebffc3a8ddce6724e0889bb4
- SHA512 87f4a9ba09ca8dec5c9198e8e4c91ea09cbf2a27c084d9627e4ef8c88b31d646b772f01520b0761d3b6a07452cd7080726c9d592872781d36fc240c14e968639
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgZ:xGSJty8TaCyLA+Ckyq
- TLSH
  T1F1863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2