69437cc712923d6d0f3fadfdfc7121363e8253e7e7e3dc2df34fc1d9d2c25b73

General

Target
69437cc712923d6d0f3fadfdfc7121363e8253e7e7e3dc2df34fc1d9d2c25b73
Size 7.5MB
Sample260728-wkllystsdy
SHA256 69437cc712923d6d0f3fadfdfc7121363e8253e7e7e3dc2df34fc1d9d2c25b73
MD5 dc59da2c005cf7f4323984519d2a94f4
SHA1 1daefbe9cbf80a555013732ee9b182859db2fdac
SHA512 815e2c60ebaad48ad1f8a8669e60947b11a90a19b91c95f5157191feb8330564499eb5fd89125d63088db1e9c3da026f7e76f3c2d528d5f6d6fd7f5eba47b37e
SSDEEP 196608:+saV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpYg:h1RCqd5v+0CS0AkKH
TLSH
T1F98633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 2aa003e60f56b5cb326a7d96557c63abc540029a18400983bc949e4d8299b1cc
- MD5 67f066ec2dfc1f323f2eadb3bbe88dfb
- SHA1 77f47271092d0e1a6dd3ada6fb0d388e9c7c344c
- SHA512 4fe252ce82b4f3eea7439a8b680236371f15d620cfd7232c391798e94dc71669d12c598f8f5679bd26c3910904f94de9cc73c2ce4970fb43e9e548b7e1427188
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgO:xGSJty8TaCyLA+Cky1
- TLSH
  T133863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2