e270d52964284a03969107d632d42d00bf51f9830d5923f9496d63fa72b3bb71

General

Target
e270d52964284a03969107d632d42d00bf51f9830d5923f9496d63fa72b3bb71
Size 9.7MB
Sample260729-klghvassbx
SHA256 e270d52964284a03969107d632d42d00bf51f9830d5923f9496d63fa72b3bb71
MD5 7521984b88970f2ba24f5ca67957d7d9
SHA1 e1d07ae83596d5a20af932036ef9edf14e5afd05
SHA512 c2f8aef931afc4b4f3ccd1dfe2f8845dac384d8609acc858b79a8a117bc8c539f7a19d660e4d64100b9ad06f31e545fbc32160d9490c49fe326721b7f5ff7287
SSDEEP 196608:mAJMRNOVFgp1O8+vY6PX31DAEQAwpA+pzlsZZxeAJJy60+VoMh/o6:mLRoVFgDO8+vY6PHdQ9etTJJ5ZVoe/v
TLSH
T1CAA6337FBFA23F8FC408D86BC489118B45BAC08DD330F5ED4566C86AD2475A4772A879
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n009.msi
- Size 9.9MB
- SHA256 809787de45a5a6d579ea200fef1331f9ae37b2f844fe08b256016a5040badd49
- MD5 8d8ad182f89edb22675ac418d2532df2
- SHA1 dfaed53b3cf900c9f07d14990cf1f7273d08281b
- SHA512 3e02b610cf612083eff1ef499511402ac3a56396c61e6fa53553cc79b10b9a622631fb1e820b962b3ef8b9fddde272b5bd5cf76cf9c17fd2ebbf770c16d6c5d9
- SSDEEP 196608:4Jo9NyvZGBpsXoC6TopnZZsSsDKEKEsTyMXpjinfLQ0LnyrWSp80nHsM:J9YvZG7QoCTbCKhGTjLnALp8SH1
- TLSH
  T179A633EA3E833B3AC00BC7B24146612E7179BFC9FF318C9666A9791C19736203677615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2