09e1d7967f1a4a82bb4d58b818b8152c416e859f2cf758af157a0dcb65f0b99d

General

Target
09e1d7967f1a4a82bb4d58b818b8152c416e859f2cf758af157a0dcb65f0b99d
Size 7.6MB
Sample260729-cfpm9ssclb
SHA256 09e1d7967f1a4a82bb4d58b818b8152c416e859f2cf758af157a0dcb65f0b99d
MD5 5af8a6fd02a608f29fb0bde439e4eaf4
SHA1 5d3fa0d7740f3dfd040cfdb7fc2fa7f1db54f82a
SHA512 4c2bca49989e4593551599c1975fde63b70a1afbb11226e7cc46f052ca4216284fa7eb97268b446dcd361ade76d0da2fafc99f8c6f59ea3b2644b5edadcdf6b1
SSDEEP 196608:meiGfjMj9inlbKbCBBkv4KQenPPzQy1t0PPnXLUq4ycrRtYsIeLcdiUDM:mdgjMwlbKbC/XKV8cm3nX8ycrMsIeLcM
TLSH
T1B28633C3E991A0C9FDB2C0F88BA7E1F2C5D2C18E1C4E65D16DB094B11B8715D7CA9E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n001.msi
- Size 7.7MB
- SHA256 78746dd9cc75db44a8796827bb1fa02da6191a912ae9961cc859d3024872f45c
- MD5 f3e444f30ac1ee8033854488922db6c7
- SHA1 faef50bd0f984dce063b7a9ed77474f614268b59
- SHA512 3eca4fbf9746581ec4772712df7ad89ce644b9fac5e22cdc41c73e0937332df01ceb7311f629d6b4afed4952bbe3629af2fa3550f92308914989cea9d5f75e33
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWD1:nAGiNMwnbQvQTyhv92ALhve0ETWI8KhM
- TLSH
  T1B48633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2