d397d7a5cc96fc7b9b3501d15dbe599a3216fe44860aa74788b74e461f0b4613

General

Target
d397d7a5cc96fc7b9b3501d15dbe599a3216fe44860aa74788b74e461f0b4613
Size 7.5MB
Sample260729-vts7qack31
SHA256 d397d7a5cc96fc7b9b3501d15dbe599a3216fe44860aa74788b74e461f0b4613
MD5 26fa2dbbf731b5d6c07f45b37e587650
SHA1 94698af268c0590eabee6fcbb15ec60ba6ef8ef3
SHA512 09160c3686c273361ac819128f4332e120ca7336eb3ec03ddb650359c89f183fa53ec095346d32a3b01ceacce0a46ed7497ea6cbce22d0ef860e6c014b0663d5
SSDEEP 196608:YsaV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpYo:H1RCqd5v+0CS0AkKn
TLSH
T1FF8633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 3879711564e484ee507585b00b0b145a7824e25f0ed1d32ce8d837f73fffd20f
- MD5 9326af203eb7d3730875cfa6e8be33d4
- SHA1 cb23612d996feec13738659cbfcba99aea55fc46
- SHA512 9c6cbf216f9de581a6b08fa9463b14c61b71e83248801a28927033f9dc3ca8b7f3c84394ab37ead31963349024e695075fe882540ed0e694fa93a1b4a3521b09
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgj:xGSJty8TaCyLA+CkyM
- TLSH
  T193863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2