308437ef2d6849ed59a51d988d25a28395f7d16b2b4bd2ceb5ce3c98dde0ff8a

General

Target
308437ef2d6849ed59a51d988d25a28395f7d16b2b4bd2ceb5ce3c98dde0ff8a
Size 7.6MB
Sample260729-cbanjssbnb
SHA256 308437ef2d6849ed59a51d988d25a28395f7d16b2b4bd2ceb5ce3c98dde0ff8a
MD5 fae6d4c5890ce816f2de6c6420de0e66
SHA1 88a7e46e56f514817a037b4dc6d9a1d783be2f2e
SHA512 ee8d8d0c531bc2f29e0025fda316e63bbfe419d16605282b02bf95143ec863b7b7c6b26c52515dc4d69fb204a0173db40154091dcd00afb864f9e706ae1f55d1
SSDEEP 196608:yeiGfjMj9inlbKbCBBkv4KQenPPzQy1t0PPnXLUq4ycrRtYsIeLcdiUDq:ydgjMwlbKbC/XKV8cm3nX8ycrMsIeLcq
TLSH
T1E48633C3E991A0C9FDB2C0F88BA7E1F1C5D2C18E1C4E65D16DB094B11B8715D7CA9E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n001.msi
- Size 7.7MB
- SHA256 c4b81b55cd622e1a490dd78832d443872ad67525fd468c744f579fa09e9354e2
- MD5 d72b1f397cb4c2abfb98a7993219c1ba
- SHA1 0580c5ea27e6dd5725fe11bb0503dd2f5e9fecb6
- SHA512 f7ac86e7695b072171be7f1bcd688fdb96e465ff3afcb40a268b4b2b72374fe422b47b9d7144ab92d3d74cd230c7e2d53905234734683f85bfe6affa182f891e
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWDQ:nAGiNMwnbQvQTyhv92ALhve0ETWI8Khp
- TLSH
  T1DD8633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2