71302932e41007fb542bd010546fd94c22e4cc8a5cb2b651bdc42e5da7199c61

General

Target
71302932e41007fb542bd010546fd94c22e4cc8a5cb2b651bdc42e5da7199c61
Size 5.6MB
Sample260730-afyj3aha92
SHA256 71302932e41007fb542bd010546fd94c22e4cc8a5cb2b651bdc42e5da7199c61
MD5 ecafc549e51d21f2c04c1b5a49a6a0af
SHA1 b51fce159fd6bb755b56eb9bff26b01e1e7f81a7
SHA512 0bc8885e3b7133b23f8644fdb8210d0edfd632ff509bde13bc51334f089faaea5d98f0d57c04b530f02ae1f5cf7923238809122d3a9e0a8ee3f7e431fcd10825
SSDEEP 98304:qSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLK:q2QSMXAmxSgzfpSr8pE
TLSH
T1E146331472FADA647471ADDC7E7E5F4261F76424D824D76E82703AF3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 c53d877ad301a09547c431c07e1f114a393c246724f31f0827ada95b930ec0fb
- MD5 648f28ac4d782d7d0257e50efdd076e9
- SHA1 43ba548c52bd8807103dc588ba92d220c4201799
- SHA512 c25a3639170b5a61663f5e024b91fe1ca52ddf3f5a69d32dfb304991518e0930f9015d3ed6d881c09747e06a87b7188c0df2a8095da9c6a767bb91eaffba3f4b
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHl0:8dCis4BEoZJLm4Kv8w+Gzer6
- TLSH
  T1755633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2