c14c0eb0f5b0dc68142704df1ca179d1420715d59dc4aa50c628fa5d5d31a6ef

General

Target
c14c0eb0f5b0dc68142704df1ca179d1420715d59dc4aa50c628fa5d5d31a6ef
Size 7.6MB
Sample260728-y7e4ssgr71
SHA256 c14c0eb0f5b0dc68142704df1ca179d1420715d59dc4aa50c628fa5d5d31a6ef
MD5 6bf7a3c7db989809da982a9d97a6fafd
SHA1 383f98f8fa521c53a41bec0e7cbea12d5cfb15f8
SHA512 a210bde2106c9d6adc93540de4bf9b2886c7c99eba22bcf50a8037aa59ba3a195d5e445685d8a4630b608c538fe2f8f36b71b51213a7362da4eadd11fc717536
SSDEEP 196608:geiGfjMj9inlbKbCBBkv4KQenPPzQy1t0PPnXLUq4ycrRtYsIeLcdiUDF:gdgjMwlbKbC/XKV8cm3nX8ycrMsIeLcF
TLSH
T1228633C3E991A0C9FDB2C0F88BA7E1F2C5D2C18E1C4E65D16DB094B11B8715D7CA9E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n001.msi
- Size 7.7MB
- SHA256 d1d9bafb94e1034e767a0b044a22bd6fce45ea8336996614edbc0b84e46de1a7
- MD5 70f0d0195827d27c5f72ccebfa6bd80a
- SHA1 f57efa029c9f110ba608a628f949d09c3c4554cd
- SHA512 0b83e2821230428483d20f941a5cdfa75f0baa011a76bffa5e2951a5ca059e6e0204a18cec42ff289b5cb6f7690b7958bb8e1a9f8d8ab187fc8994afb27e70dc
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWDa:nAGiNMwnbQvQTyhv92ALhve0ETWI8KhP
- TLSH
  T1D18633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2