e61d52d1791a7cb08ad7bcf9bf92ae0524356653c153813a4e501c492ea83a6f

General

Target
e61d52d1791a7cb08ad7bcf9bf92ae0524356653c153813a4e501c492ea83a6f
Size 7.6MB
Sample260729-smfxpsam3s
SHA256 e61d52d1791a7cb08ad7bcf9bf92ae0524356653c153813a4e501c492ea83a6f
MD5 bc5cf60dfc419ff1a572d4faed70ce89
SHA1 4c2767464639bc07c07336eeeffafef2ed2d1ad9
SHA512 c31c85f233e3b3834119039d7ef17fe1bc03c3f3209b43fb5eb114a3d6b12b1cc074b025a48fd0e29869abda8b8a663f0650da1f4ed817e2b2c1604ba2af3f53
SSDEEP 196608:7eiGfjMj9inlbKbCBBkv4KQenPPzQy1t0PPnXLUq4ycrRtYsIeLcdiUD+:7dgjMwlbKbC/XKV8cm3nX8ycrMsIeLc+
TLSH
T1338633C3E991A0C9FDB2C0F88BA7E1F2C5D2C18E1C4E65D16DB094B11B8715D7CA9E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n001.msi
- Size 7.7MB
- SHA256 1d3a933b2e2adf8a838ff106bca9e0c20284b6f98f7d14cf6a9d09fe16b836bc
- MD5 3f674dff560f4d9c1baeed6ad312b1f6
- SHA1 a11959301f6d5a6816167efa8addfd1097ae64ed
- SHA512 fd814f058af6c6c368dfba2fb68cfc20785da96577c6216b50a4f956f4949fd62f7c5276e1997a1e6a421ec869dc4318de96e153185b043fbba43dcb972f395c
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWDy:nAGiNMwnbQvQTyhv92ALhve0ETWI8KhL
- TLSH
  T19F8633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2