4759ec76357b1aaa397987ddfd7bbbb8b6c6d46030a55c3158ca81ae0b0a1178

General

Target
4759ec76357b1aaa397987ddfd7bbbb8b6c6d46030a55c3158ca81ae0b0a1178
Size 6.6MB
Sample260729-dbj3navvgz
SHA256 4759ec76357b1aaa397987ddfd7bbbb8b6c6d46030a55c3158ca81ae0b0a1178
MD5 8333244add3f0ddb4cf76a2d9c41e5d1
SHA1 1b7889b1922b82399231c08cf07954abc435e5f0
SHA512 e918cb437b391c5a2345fc14b868ed81d781812abc1a9718b5328be7268e33b1818f1d806098b04befbf7dfbf43cc500a65188ffe705787eaa318cde62d659aa
SSDEEP 196608:MzsUuJYGpVfhn8xH9EFl4WU2xsHmY8s4iw2sM0Z:MAUuJZr5n8xdErHTskiYMC
TLSH
T189663309F3C01AA4BFCD957613BD1693D1E75264B5AAC971647E333BF0CA26B6824383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n003.msi
- Size 6.8MB
- SHA256 218e8a1d588515a1450aa2bbe27b962c5923e56b90bbf559f297eb5ce8e75a2a
- MD5 5bdb513f01a39bfe91286f6e7b7f78a9
- SHA1 0e1d9c39d8e1d30700a6931851c51aa686dad7cc
- SHA512 8d6d5561c60c9826103b5f4d24d930d77c2c5a59b6b50de871a83d82555a958abb73b3ff8b190e7df3f367eac1487c19069cca86fddf10ec922d0e35f81cec5e
- SSDEEP 196608:Xilcw0Iv39df8Dt7kvgmswdObgc8Eu04gkcSG:mPnf8Dpkvv9Oq0Icn
- TLSH
  T14F763386F8C112B5E18FC3B0419625AEB86E3FD97E678C1A7A7833116E7372E5531381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2