14d5909a15cfdeca6791c538a38bbe859c061325f2e1127f8259184c1829ed70

General

Target
14d5909a15cfdeca6791c538a38bbe859c061325f2e1127f8259184c1829ed70
Size 9.3MB
Sample260729-snmrmsae28
SHA256 14d5909a15cfdeca6791c538a38bbe859c061325f2e1127f8259184c1829ed70
MD5 1e8fe5c499367bda269965e1f0f5fc58
SHA1 756772cc71eae975ad3d339a175369f300f38a69
SHA512 9698ae11a9ba904555ecf5000f1eabd497d77fa93cefca37f99b34bd2d0ee1e4ed401061fc1df8bff95d4e8e53d67da1b4bcbbaf118d70f0c052a26ae50aefaa
SSDEEP 196608:t+jTLuzHs3HtrJMObailbopi2lT57dS+zfsUAUrZ6D1KJL1P:tYfq69hUY2dN4UAUFWo
TLSH
T138A633F96130A94D573A9ADCE3216B649BA331B1F4EF2F8B13060518F5B0342BD586ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n023.msi
- Size 9.5MB
- SHA256 35581953779fb84c3aa498328e4947e08d523861110ae80c39b47b39a23f6627
- MD5 c2990271f5a89ebe60e90755b2cc6415
- SHA1 e19e626281a4e14341d738b8734b39cbccb83e7e
- SHA512 3d424f9885c694643362971d9b312203dc3dac4ca6a66da2cef1b349d02383f5b2c55511d883e26e56b438bbcb2ade1b9c744a34b8f050e1b4e24523ff621495
- SSDEEP 196608:dzqVHuTf6bLcf2T7sqTYNLa+NdwprkZkyzT39f04FnGq0QrtoJ5kJh17:dUOOvc+CLaoSylLUq0QhSG
- TLSH
  T1DDA633D1798433B9C36BCBB45212B97C7D693F51F6AA4E0B378D3600ADB13126A72394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2