c03cb40856fcd6484302dd74d687be68e2d00829aaa057c67db33c1353569662

General

Target
c03cb40856fcd6484302dd74d687be68e2d00829aaa057c67db33c1353569662
Size 6.6MB
Sample260729-tmdysabl2x
SHA256 c03cb40856fcd6484302dd74d687be68e2d00829aaa057c67db33c1353569662
MD5 80fc903996a94ae57c9274b737234e37
SHA1 47050508e84fc82a9bc372e18cdfb3bdc5834275
SHA512 4cfc9375c374c955df9f002c67eba4f221c23642a6f6d02a25ad15416a49809c4f30449aaf1aff5059d28924c7a1d3449815d3c4bbdf0f13787e40c3120f1224
SSDEEP 196608:tzsUuJYGpVfhn8xH9EFl4WU2xsHmY8s4iw2sM0V:tAUuJZr5n8xdErHTskiYM2
TLSH
T12F663309F3C01AB4BFCD957613BD1683D1E75264B5AAC971647A333BF0CA26B6824383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n003.msi
- Size 6.8MB
- SHA256 6235eeab0e661ae702431e1029ba8f7f6d5d7c817613ccb7dcf0402e2dab7b17
- MD5 e92f040686e60d35756f3a75a0b31d4a
- SHA1 5f2c8d0883939bc12450f9efe8ec3470a4e787c7
- SHA512 12d1228c3dc4fcd69e001a76a2073fb763400c2dd1aaf838337306f151e9325f4baaa1976531a6de0f5c99e2f9c21944b28e19bcd321803d6abe0570ad72fd0f
- SSDEEP 196608:Xilcw0Iv39df8Dt7kvgmswdObgc8Eu04gkcSJ:mPnf8Dpkvv9Oq0IcY
- TLSH
  T1D9763386F8C112B5E18FC3B0419625AEB86E3FD97E678C1A7A7833116E7372E5531381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2