6f6acd02d14cd3fa0e5107bcfe78c8c3cf3bd3cc799a93bfda9ba2189e9b77bf

General

Target
6f6acd02d14cd3fa0e5107bcfe78c8c3cf3bd3cc799a93bfda9ba2189e9b77bf
Size 7.5MB
Sample260729-vv6jfaca69
SHA256 6f6acd02d14cd3fa0e5107bcfe78c8c3cf3bd3cc799a93bfda9ba2189e9b77bf
MD5 b6fc7b7246e5fbac1dab99787d21171f
SHA1 93387d03059e3afcfcb03ae461c0142f5d23c7cf
SHA512 ef40e828a0c5d62afb61a561faad127e0eae68523c3c3c0d152f8b65396c63b4d8c53037c67487a0138134378988a74fc3518490175a48475a27f0eed1ac0c16
SSDEEP 196608:SsaV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpYD:F1RCqd5v+0CS0AkK4
TLSH
T1E38633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 bd329b12102a3967cb72919bd9e59403b08bc33964c681e19ad8d4d294627fe1
- MD5 86dbcacc1bcf35937bce3b201ee80790
- SHA1 865f94199ffd3220a28c41a98cbacb407c511fb5
- SHA512 1186b6da6d7a94871249ceab29d954e61c96da66bccc2b368aed27eccb88ba110380fbe7d91160d75cc6e642117ec80bcdae48f6e03e541982d689a12f6b5116
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgz:xGSJty8TaCyLA+Cky8
- TLSH
  T107863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2