eb400406c42ceb524abe41fb24317ad23b3e942f6dfa27f35259f63d31cfc446

General

Target
eb400406c42ceb524abe41fb24317ad23b3e942f6dfa27f35259f63d31cfc446
Size 5.6MB
Sample260730-afyvtsha93
SHA256 eb400406c42ceb524abe41fb24317ad23b3e942f6dfa27f35259f63d31cfc446
MD5 3a3baeebe2e27706170b1523794a52bf
SHA1 81cea436eccce8861632abb19f25daf0e7b1e967
SHA512 0c65be75ef0e14ea89bdc2d1bd6ba22b0e31d70cfabd0c1e1f64878d8924a4083f452b18c73aa9cd8a3ebf66d3a02ed1f7562fd7ef8be4fb0bd39d130581fcb7
SSDEEP 98304:oSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLU:o2QSMXAmxSgzfpSr8pW
TLSH
T15A463314B2FADA647471ADDC7E7E5F4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 9c5bca66d7d616c8e91a0e825677c0b413bf3d154b4e5f4eb1e00aed2f08bc55
- MD5 d401d635aa0134a5d1a6343ea1ece8c8
- SHA1 47e7e5d245c4ca5c187d02e42e6b389761dfb00b
- SHA512 4162f72aa828a39e3aa3a87d4f8e96430d95663be32b61b6e66775049b4909171bb18369e684c94c097a96a66b05bad3daa464d9961fa4c94fdbbd52437c984b
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlR:8dCis4BEoZJLm4Kv8w+Gzerf
- TLSH
  T14F5633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2