6fc3c90b8be1b201b486727b5ffef8c994a98c5b1f2c31624a842082c25e8e21

General

Target
6fc3c90b8be1b201b486727b5ffef8c994a98c5b1f2c31624a842082c25e8e21
Size 5.7MB
Sample260730-2ke23aydqa
SHA256 6fc3c90b8be1b201b486727b5ffef8c994a98c5b1f2c31624a842082c25e8e21
MD5 c13c3d0aa66a55c955753ea5d243ebc4
SHA1 208615414d14e2073362d7fd90021a11a2e24bd9
SHA512 697f037ea4842218bcf0ddeaf136952b708107d512e8da28d9b96aea3bbb2987fc344b358ba593dd54a5a6cfb8dd03b158f4980e34ca95cb0f539ec2f21afe7f
SSDEEP 98304:Apk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZt:ApQ2t+vqHD9t2tbCvZdC6TQMz9BP0QXp
TLSH
T121563359A33E89E714F33FBD66858F35608EBA53BEDB890CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 caa344128796cf5bb3287e8607c13b46669369aec606b9f5934f437bfe638339
- MD5 5f3364a9d528475807a2bb7e2d1282ae
- SHA1 4b8ca1f271506bc01b9337fb2cbb5840768fcec6
- SHA512 f255ad3f67fa812d0debee351ee8c236b09505da1ecbdb21511e9261e8528e4bdedf2212a92911bb82dd7fbcb4a071979e76121df78dc74591e5fc5e46251dbf
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHR5:3yOPsdq1N9vE1bPEiGut9HzgcPGY32Kz
- TLSH
  T11D563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2