b7c6bfc53011d5bc8356e7093f4dfc16447348951cb3ade060c1cafdd3176703

General

Target
b7c6bfc53011d5bc8356e7093f4dfc16447348951cb3ade060c1cafdd3176703
Size 7.9MB
Sample260729-rmy8lsxyaz
SHA256 b7c6bfc53011d5bc8356e7093f4dfc16447348951cb3ade060c1cafdd3176703
MD5 c884ef908e0c713c523cd4f14fef5984
SHA1 c049d865dde71e77dd91d51f340cdd2cacec584a
SHA512 6aaae7342a1d656f1566aa292017129a79355aae5b29658f9b1361e8cac6c868ef1f0df9a6143a04d7fb4818c8679e789b11a9fa3186dc208de3a621f21f3276
SSDEEP 196608:FEZ+Q2CNQK/r1a7m3m9/bZfkpQyEpvllAT+G0kEyi3n5b8:FEZIsQeRL3mdIwPweS
TLSH
T18486338ED305DB82824C19A7C3206DE22E65C967CCFDDB95E587A043934ACF97D9C2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n022.msi
- Size 8.0MB
- SHA256 63886295afdde4de6d41372691d2761e0e5c737a917119434de74b83a557864e
- MD5 05eb8cb2da756c311fb2740caaf99921
- SHA1 2100f75a6aedb8eed77bed833dc5962b8a9cbb8b
- SHA512 0207854a62e3e7de2893d57457d66849ccb315058aed2741f3d3602c0ba086dfbaf59a8febddf0a39fc1b69f6d95b908acb4f15b35f888a9aecef3a26b0ff73d
- SSDEEP 196608:gAftmXQaZsqxv5apGlSXrbMeQcx0yE71pBEfkgokKqcFLlrC:gAVGsexFlS/zN01W+0
- TLSH
  T10B8633C6BD89A371C08BC3724112B5BE31297FD1FDB6CD02F6EA75005A7392958B9386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2