273be8fa9ae0beab9a5cc9250ea0a8a9a97caf1b8d7835a5016694c001cdc7e1

General

Target
273be8fa9ae0beab9a5cc9250ea0a8a9a97caf1b8d7835a5016694c001cdc7e1
Size 5.6MB
Sample260730-bja4lswepe
SHA256 273be8fa9ae0beab9a5cc9250ea0a8a9a97caf1b8d7835a5016694c001cdc7e1
MD5 4f568e7caa98454cd45f57260c7f4f7b
SHA1 edc70c190dabfe653d095f83c1f3f59ed13fd14d
SHA512 6a0bd1a3a2e20228c5c0636692030f429d95c8f064b70a64628799f1b59ea332e86965bee0fb44493b8d5ad7390c2db53389fd75e78e8cc63db2957146e1866d
SSDEEP 98304:zSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLr:z2QSMXAmxSgzfpSr8ph
TLSH
T1BC463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 ea5a7b848935ecbeb8a96165b733da6332ef28dbe0d027692b0c1b8e3bcbb6e5
- MD5 0dd24e6685a4386d4b1e9cd87a12384a
- SHA1 528ae87eb50bd421a746c4b8aabdac5a892e0bd1
- SHA512 1e6ce7a41455d791ac72dd5171dd73e1543cdd8374831709c1d35e9420cec90ffb522683a8575d40073ce45c0142e7c79456ef62f3af1000628adf832a696878
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlQ:8dCis4BEoZJLm4Kv8w+Gzere
- TLSH
  T1EC5633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2