4f17e33a12c5369ba8fac81c7f9f5bd2417a4977654a4b401f374672b97e974f

General

Target
4f17e33a12c5369ba8fac81c7f9f5bd2417a4977654a4b401f374672b97e974f
Size 6.6MB
Sample260729-dbkdesvvhw
SHA256 4f17e33a12c5369ba8fac81c7f9f5bd2417a4977654a4b401f374672b97e974f
MD5 21ef35a0ff7b01b820333a6e044bb45e
SHA1 22388f9403b0fbd8de799e304b35be6148281837
SHA512 67eacfa83149aaa097fd7defed730c6d051278c6bc1daceedc7c6d1079b86d1e60711ffa6c3efb09c37ae7ffee9015484f84c61bcd9a66224a2baa370d52140a
SSDEEP 196608:rzsUuJYGpVfhn8xH9EFl4WU2xsHmY8s4iw2sM08:rAUuJZr5n8xdErHTskiYMf
TLSH
T134663309F3C01AB4BFCD957613BD1693D1E75264B5AAC971647A333BF0CA26B6824383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n003.msi
- Size 6.8MB
- SHA256 54a82c80366d8883e1f7949022fc57c7b1eca31959dbf03b2388268799543b20
- MD5 e362c7d95a67ee12c824b8f41364852b
- SHA1 057f08d8586b909a5fb06e6468f6c4f21fce7278
- SHA512 2659f3ece99c16abbed87eec0d36f68a7edcba9afaabab6ccbfbe346c2c8b5c9f172c7c30d7ca62df3c3699f2febfba51fab3cadb11d3913b7acf3e481adb222
- SSDEEP 196608:Xilcw0Iv39df8Dt7kvgmswdObgc8Eu04gkcSx:mPnf8Dpkvv9Oq0IcQ
- TLSH
  T1D2763386F8C112B5E18FC3B0419625AEB86E3FD97E678C1A7A7833116E7372E5531381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2