e7f11144c9681ef787a2963fbcd096bf32b8ad66570c8f839d9dd53cb85061dd

General

Target
e7f11144c9681ef787a2963fbcd096bf32b8ad66570c8f839d9dd53cb85061dd
Size 7.4MB
Sample260729-pf446stela
SHA256 e7f11144c9681ef787a2963fbcd096bf32b8ad66570c8f839d9dd53cb85061dd
MD5 c916dd07e04eaaa6191d659a12f85bcb
SHA1 9e13456a0d9c25d0d5bd7c226af23765fab54cba
SHA512 307a41a0dbdadcd1c409f903ac435fd237d7e7fcff571c7f94ec83259edebdd5bc389ef7ea5327587bab3d8886c0f0fdb00e366a8ab3272121781fe315c7aaba
SSDEEP 196608:aVIvVOMIVzyZcE41kP6jFGBs/TiLUzWumqftqJ8hZGiF8:/vVOMIV0cE41kP64mbiod/0GhZ58
TLSH
T1BC76338B90B330152E91021497AEC0C69BD97C382B56E543FD1F74B1D78F7ABA9A64C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n016.msi
- Size 7.6MB
- SHA256 dad79f2b737389d8a64b08243179e453a56ac9463a358a2414d92a70d0e67686
- MD5 42f2a9806f63e3645f8c57104d2e1d40
- SHA1 84a911841db611c69cceb6d00533ec06de264509
- SHA512 40b0ec1b518d384352cc07b3f24af3b773f92875c4297f700a7e9eec9e0b42fe2430e427cfb1d6b21e0146f319fd60b2133b9c7374195a65cf1f52e0ef9b0e91
- SSDEEP 196608:abHbJEFnpsQyLt2ZwUGtmGc3uk0C9bW3i7WqIYht6La9lwGrA:a/JEvsQyLmwUGtmG6ukjFWSrNku9lxA
- TLSH
  T16386338678D232B1C587C371869BD89E7E283F903FA3CD12B99E35110E7773A5676242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2