6aac440f4a77d219687a269a72cd1eabb581a5142676c18effa8c9be70bf9eb4

General

Target
6aac440f4a77d219687a269a72cd1eabb581a5142676c18effa8c9be70bf9eb4
Size 5.6MB
Sample260729-14e1qsff49
SHA256 6aac440f4a77d219687a269a72cd1eabb581a5142676c18effa8c9be70bf9eb4
MD5 ce7a2d6ee5c4ae3cf39ecc2359f6278f
SHA1 e3c17320a0ab2ab7b3ea4144dcde18ef4baa764a
SHA512 f14f903836e88ecaa7ec9895824087a33fff1c255af134a18b28db9c8f1f0b1ceb22d8c314745645bcc030b462a87c878298302b944db043a7dd849c19695076
SSDEEP 98304:7SXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLp:72QSMXAmxSgzfpSr8pn
TLSH
T1F7463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 951a91b27216f22992a54393baaa0a0b48f535bc778aebbf27dd9c786c698985
- MD5 66b7ef9be3e48e0c84093cf430445135
- SHA1 1c188401be4f463716f212d76478e98a0f9d0578
- SHA512 9a9bbe1902e5812b5680c3df4756de02990111df7566989a6aac2c1ad42cbf964e56661f9843550dd000dc538f35c53abf7091104bcd9158468bd5e31ee6eafd
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlt:8dCis4BEoZJLm4Kv8w+Gzerr
- TLSH
  T16E5633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2