d3062b4a2e418664300d6ca06da37128c2333bb693e226872bb2ee07371f40e4

General

Target
d3062b4a2e418664300d6ca06da37128c2333bb693e226872bb2ee07371f40e4
Size 5.6MB
Sample260730-bjag3swepb
SHA256 d3062b4a2e418664300d6ca06da37128c2333bb693e226872bb2ee07371f40e4
MD5 9e8b844eb0d480f9370fc30e90ce38ee
SHA1 9cb36382cbbe6a426d4969b6b721d5f0edeccc1f
SHA512 d0b5c431950becb7ffec10382860e7c95cbbc477023b11d883b18755125e7e08f802d0916a46bb6da9bf504cc00d284bce7324b0999926b9bcb5845404945c10
SSDEEP 98304:QSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLQ:Q2QSMXAmxSgzfpSr8pi
TLSH
T107463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 892c802ff1e991337529bc3ada72799592a0b42fe377cb12cfc5cde7e96a4f19
- MD5 e9bd2265c0ee4b3afb89f692d7282bd0
- SHA1 4da157b54c22c8929e7c11a69fb95d50e3ce567e
- SHA512 0c0bb039cb35d48fffa3fb9f267957aadefbf7a32672dad4b21a8afde2ca955cf159a4ffcc4ec8edd89e14f2ab4b3c0de410eb4da2273e3febd4476af152ff04
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHl/:8dCis4BEoZJLm4Kv8w+Gzerx
- TLSH
  T1245633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2