03545f5e58c281c2b4bcf6828e8044cefbe3c4bb332918112fb0df9c1cc8d09a

General

Target
03545f5e58c281c2b4bcf6828e8044cefbe3c4bb332918112fb0df9c1cc8d09a
Size 7.5MB
Sample260729-vrjkhacj6w
SHA256 03545f5e58c281c2b4bcf6828e8044cefbe3c4bb332918112fb0df9c1cc8d09a
MD5 4bc284efb8f1fe1af84015683bdfe301
SHA1 da2962a0e0e13152da9d3938c2bbdd144eb64abe
SHA512 6d91097a1d71136eaea9ce6cdcbc4cd3404cd68f4d01e18b9d0b91aae37248bef0754ad0e2369dc56074c6a2b2223e4dc4190b696d23b49adb4f0da8a6b3705a
SSDEEP 196608:6saV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpYr:91RCqd5v+0CS0AkKs
TLSH
T1C98633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 eeb1cd8a5fa6222a264c53ef311035ea14b5128fdf7889f7572d0bd0ff369c77
- MD5 427fdcca73173f3b2c22d4b798549493
- SHA1 d33bab4af39a76939708cc22bb91c5b881de3b00
- SHA512 88eb95f2103126facfdd0e301bdb89496ad5a18684ecd47e058f9f2a98aab6936fbea677f6176791fa4daba055b94ee488a9a42eb4061dfafbe50c36f47e4e84
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgb:xGSJty8TaCyLA+Cky0
- TLSH
  T1AE863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2