0f11916d78da6b1bc9b84fab3e6662a70cd4bbcf90b962d31f88265231267f09

General

Target
0f11916d78da6b1bc9b84fab3e6662a70cd4bbcf90b962d31f88265231267f09
Size 9.7MB
Sample260729-kls7mscq5v
SHA256 0f11916d78da6b1bc9b84fab3e6662a70cd4bbcf90b962d31f88265231267f09
MD5 a566e8e8a1e8d8cf30bbc968ccf68935
SHA1 8300c3f18c376c51274fc78a6693b0ec47f145db
SHA512 8d9803239c4aa27265785948169c6b711801b854109eac3805703e5f53fbf5cd4558f8099095a978350246070bd79e932cdf16970f4ba645a9e2504b2b9b483b
SSDEEP 196608:YAJMRNOVFgp1O8+vY6PX31DAEQAwpA+pzlsZZxeAJJy60+VoMh/oD:YLRoVFgDO8+vY6PHdQ9etTJJ5ZVoe/e
TLSH
T14EA6337FBFA23F8FC408D86BC489118B45BAC08DD330F5ED4566C86AD2475A4772A879
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n009.msi
- Size 9.9MB
- SHA256 c8ffa3841b1fb9d65dbef4685abe470894dcb31419e467cb3cf9184a32485625
- MD5 09207a7029042d3ebf8cdfa42905eed8
- SHA1 523ed4f4af537d7ed661b2594992058534959019
- SHA512 be90d0d807a3ecb56c31316648b181d282cb401aae4b4f9b54b02239dd0cf8dd9ec2d52aa657d08775e071f934f1a628c6b2eeb9ae0306ad763c0dd94a3942b3
- SSDEEP 196608:4Jo9NyvZGBpsXoC6TopnZZsSsDKEKEsTyMXpjinfLQ0LnyrWSp80nHsO:J9YvZG7QoCTbCKhGTjLnALp8SH3
- TLSH
  T1B8A633EA3E833B3AC00BC7B24146612E7179BFC9FF318C9666A9791C19736203677615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2