2842a101027db7b444ea622ac617aae60157f6285c4452051f2e271e72aebc4f

General

Target
2842a101027db7b444ea622ac617aae60157f6285c4452051f2e271e72aebc4f
Size 5.6MB
Sample260729-3cddyahn4v
SHA256 2842a101027db7b444ea622ac617aae60157f6285c4452051f2e271e72aebc4f
MD5 e52de831ee85022480c5538b5fd4c50c
SHA1 1ef5c9d6a0f31910eecb22f3b8d5c8c5f5ff23d3
SHA512 42a1533e9a685b02d16e7ff403eb29031968889788e7b120096793e2024baa7bc53d1b8921def40835441b0df7263fda14862dc08f94df00f965ef425e7dc0fa
SSDEEP 98304:mSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLJ:m2QSMXAmxSgzfpSr8p/
TLSH
T18646331472FADA647471ADDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 99b77690dfb58e60dbf5df6263c0783bcdf43a307ee15d1f963f10cfda493b17
- MD5 e5cea4e0e2706045c228c4a8f627f59b
- SHA1 5922a6bdec4786807ad8f00081f5e6525f456a79
- SHA512 76a29518f8ea93b862d78a83ec3c073d721d2fdc7e620f96cc3a605afadbdb7c184ffbb01240ad240cdd25cd80622a39a74ee65ee61658a789e783e8fd0725fd
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlp:8dCis4BEoZJLm4Kv8w+Gzerr
- TLSH
  T1805633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2