e444ac5a531eb4aed4761a955a51def759e1160457d7a34e412d79171f5f31b6

General

Target
e444ac5a531eb4aed4761a955a51def759e1160457d7a34e412d79171f5f31b6
Size 6.6MB
Sample260729-tmcqqaxdme
SHA256 e444ac5a531eb4aed4761a955a51def759e1160457d7a34e412d79171f5f31b6
MD5 3dd0290b9497722a6f05246653de3dd8
SHA1 a128154e6436ebb61acfb463352b1cc89df5dcd3
SHA512 49db2d444d3cbe1dc1b3750e65abe9a4062a30c2f9eebf9ca45a7b32cf24d55dac0ce2b66fc7a33d1949c8e68efdb395372b6200073b9906980b068102982e1f
SSDEEP 196608:QzsUuJYGpVfhn8xH9EFl4WU2xsHmY8s4iw2sM0L:QAUuJZr5n8xdErHTskiYMQ
TLSH
T193663309F3C01AA4BFCD957613BD1683D1E75264B5AAC971647A333BF0CA26B6824383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n003.msi
- Size 6.8MB
- SHA256 a70f0db9886f2c2c14d2bbf4baf55a995e209ef6219db92623b5feca14c78210
- MD5 977a30cb596f5cabd4e59dff3ea9b5b9
- SHA1 88a4627d90c557ca0d50662e0fa5e9539c19f8a0
- SHA512 bec2a678163bdbbe8c4c06bf469b996ec2a451942221766cc8d5a424a784be78dc774c49579b3159e9149f85bacf98df9134adf5e07e556432078c58c359d23a
- SSDEEP 196608:Xilcw0Iv39df8Dt7kvgmswdObgc8Eu04gkcSB:mPnf8Dpkvv9Oq0IcQ
- TLSH
  T1B8763386F8C112B5E18FC3B0419625AEB86E3FD97E678C1A7A7833116E7372E5531381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2