9d559ab9e9849b624a9697de68dd85a1cc2c5b5ff1ec56900fe594f6a5348fca

General

Target
9d559ab9e9849b624a9697de68dd85a1cc2c5b5ff1ec56900fe594f6a5348fca
Size 5.6MB
Sample260728-vhsf2scr9w
SHA256 9d559ab9e9849b624a9697de68dd85a1cc2c5b5ff1ec56900fe594f6a5348fca
MD5 9ad3f78494bea0eea9534e21bca671b1
SHA1 77f034f31b06da4979faa45d4f940be7520c040f
SHA512 9fa7c46a8bd3185b2f404a2907c0eb69889bc7397e6f092ef0d8da887cb76e3dc08a3104b4e1281753915e327f27fff09dd44ee498094885ea7a368698b339ce
SSDEEP 98304:j/hOUsM6GtgI+9m+mZApP9CXkCTA2+dE97jDJdHfL8JfYZQXbfU2U/OhEx:jgUkIRsITV+dEVDJdHQJQZQXbfUcKx
TLSH
T1FD463393CE2A9C6C71153F9D847D7898203FA14D4CE218676AD89C9EF31CB93167CA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n006.msi
- Size 5.7MB
- SHA256 29b614dcbcda8d101b42dfa4102e23d2527b0ce19186670319007f67e4ead04f
- MD5 4a99f000e5577989dd6b1ca1cda15c09
- SHA1 9e52e538e577227686a5e21ac3b0806caf1636f2
- SHA512 886129d049611cfe900034e4d44b608e3128f427d49a33334316d231592789071c11ba3daf2f296aec3c154e61726feeda4d4710b58d97f14d84c45c5ffd11f5
- SSDEEP 98304:S8cgy6clie+JgyKLMpph2Dou88gnXVDhP9paXrh07f8fafBdYGS/ChEw:tcyeLo8Db88gXV19paXC70fafBdYwKw
- TLSH
  T1C85633977D8A6778D047C7B9805271AD301E3FC98F724C5B3AD87D4C6A3AE0518BA70A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2