08eb669c102731f41fa89e27df0618983f7835e60b41fd11c579fb198941a166

General

Target
08eb669c102731f41fa89e27df0618983f7835e60b41fd11c579fb198941a166
Size 5.6MB
Sample260729-y4bbfavsew
SHA256 08eb669c102731f41fa89e27df0618983f7835e60b41fd11c579fb198941a166
MD5 b0a54e9fc2bee2160bd10df1f198da34
SHA1 e06e27831f81ea72a29e351492f8063dc4b8038d
SHA512 860cd7fed113dd85d1f8ece2f45fefc6f1beea250ad3c0af3300213bd7f9ad39fd2e821a4524b1283eeef7a8ee94f97f2f0ba3670f68713d7878d825e4e748d5
SSDEEP 98304:CSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLm:C2QSMXAmxSgzfpSr8po
TLSH
T1DE463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 10dd09ad17a2a6b8a2e43a9fcfab8a805332379d211430e86f9a2141d3ff8e5a
- MD5 331b07b94649adf3a7b85d75424dfde1
- SHA1 abfbf0cc6de32f668299746638e4a8a14f8165c6
- SHA512 700507e7578a5f1448cec7657761aa6588eec39d9be317105cd7a37c3cf51e2f210fb53d4aebd3ffaaf2ef9f1fe00a0f9cd0d3ca8bc5bfb14839d07f47a6f807
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlr:8dCis4BEoZJLm4Kv8w+Gzer5
- TLSH
  T13E5633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2