d39003d673864bc4b2229a5c88a9f99c82144e89af9f136db3b8939ec9a5243f

General

Target
d39003d673864bc4b2229a5c88a9f99c82144e89af9f136db3b8939ec9a5243f
Size 5.0MB
Sample260729-kv3sfafd35
SHA256 d39003d673864bc4b2229a5c88a9f99c82144e89af9f136db3b8939ec9a5243f
MD5 789989c30eef6d01a7d4265f33d19fd6
SHA1 b01702aa9ac22704ca3765ce0912a665813206dd
SHA512 dbe9c7cfaea80cedceb7477a823280a9e6cc433e11ee8942f4fb47b934b64c43210e837a88dacceee195c9ca34ee24ca83428c93dd3ee2ce2f474f279ef8a6fe
SSDEEP 98304:hWK2AvnPMLC2WAyE276mhR0C6WWcPHUNMqAhojtZWNNIoDPyaoj72RU/QG1TG:hWK2AvnPiC2WAyE7mH0DcPHjqAOj7WNr
TLSH
T18836334F697F4283A53B78CB48CD89E48E34730937BCC9584D22696D92B7B9F4CE1095
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n008.msi
- Size 5.2MB
- SHA256 9348c9eefae32d42ed0549ccd2e16113e95dd40a6ae8c7a041795f2cc22dc10c
- MD5 4cdab7bd11aea2110ec517cbd3dd025d
- SHA1 4ef837e96bf5e4ce03376dc2858aa1c5f3c105d8
- SHA512 eddad2d27a6a579bcbb6057b9b319071af24d4a1787d6ef855209060d80febef1a05db88be8195c52cfcbfbd130e2c75b4f3f14fc233452eabf43a6162d1e247
- SSDEEP 98304:RIB1wodeTLsU8ESG8r663tiwGWUcBB2fAOsho+N1XBAyYRiD5iS0tMfSLYD2GrHw:RG1msU8ESG169ihcBBZOsOMXB8i9iS0V
- TLSH
  T1864633CA7CDB5732D09BD7B1808726BD71393FC67E7A4C067AA93E080E72B1954B1285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2