9b9b355e6b8157a427561dfdebece349a0bab1097564b869474f1114413464a5

General

Target
9b9b355e6b8157a427561dfdebece349a0bab1097564b869474f1114413464a5
Size 5.6MB
Sample260729-18bh4sgr6v
SHA256 9b9b355e6b8157a427561dfdebece349a0bab1097564b869474f1114413464a5
MD5 b7f88ff2fc75d5a97bdfa819d182200c
SHA1 61a51ef6b2ad3d416b9d74c737cc4dc1b9a71122
SHA512 772fa64cd91806dfcea866994116d3ad396e95f1189f82202ec2c584e23af89f0c106c9159f683544ed7bf3454a099a488c950544451de98d78b1ae310d76330
SSDEEP 98304:XSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLN:X2QSMXAmxSgzfpSr8pj
TLSH
T1FC463314B2FADA647471ADDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 0f59f2ae8f280b666c152bc786e88ef2bd88a36f8a8209981adfa1987b880c31
- MD5 8e007c672c1ce5bfc5970864cd263f89
- SHA1 79a172ac8a15c76ee624d737391bd9a75e0123e1
- SHA512 29b801d7837c5e1ceb0fe3d03d38ad0bc3059b462ee06eb8bb55a7a86a6f712205f00bec4f81ce83f2aaf976ba0765ff5ee6a2c51278a1e11645d3f7de913454
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHld:8dCis4BEoZJLm4Kv8w+Gzerb
- TLSH
  T1025633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2