7cb381463480955c0c58c851a037a95a3c9a0b5892e5702232a9a1ea7d85027a

General

Target
7cb381463480955c0c58c851a037a95a3c9a0b5892e5702232a9a1ea7d85027a
Size 5.9MB
Sample260729-ldbs3azhme
SHA256 7cb381463480955c0c58c851a037a95a3c9a0b5892e5702232a9a1ea7d85027a
MD5 4d831041d3fc6e676b7b9589dd87a474
SHA1 4c8b25051f89d435f1fc56cbe9656b05efdc5def
SHA512 bbc055f4501af6e65a3bd4f73d4aeedc627d2cdca54d80a360dbec7ad32176a239585ce0be8023ab3bdecbd7d7958f493e8805bf8f0595744523b524fbea572a
SSDEEP 98304:rO1e95gCcC2xj2ujeYf7pWMrpjAszYzNO0xYoYvNxDJeUFGuum2IyuYpYmU2qomR:61efg8QqujDpWMttzYUPzYyUquj+
TLSH
T10F5633F982E14CCBC0BB03A995B0C5BA7958B58817CD79F0B1954A2990CA3D3F753F89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n010.msi
- Size 6.1MB
- SHA256 61f908a831ce11fc52e2d95af68e4e5e1d77b6276f3aeac4b65697e70bcdb5f3
- MD5 fbf413f940c60417fb1dd78fe207b909
- SHA1 a864c87e5c84a50c7201687acce0f7def8b0e15f
- SHA512 668d757ee94bdb34de1052b02169a7179852fc5ae7207e267cc1ed73631e351e418f91de4717d5804e60648624accab59eb8f0fb89301608e2057ca9df49705c
- SSDEEP 98304:+MyiVHsB1OBOcTADlJ8QjQUJlfcIXzR+wJYdiznhmBY3WuiFUaM0o0wuYpcwU221:LTsc7AxSQ7TfcIdJJYcj6gGnYKg2EE
- TLSH
  T1A65633D57DC616B2C08FC3B09156A1BE717C3FC1AFA6AD5236E97B081C73222A5B1349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2