2bcf640aa1c8e0beb94c5476e13477b3c583cfeb2449bb8a434633c561a9382a

General

Target
2bcf640aa1c8e0beb94c5476e13477b3c583cfeb2449bb8a434633c561a9382a
Size 5.6MB
Sample260730-bk51dawfld
SHA256 2bcf640aa1c8e0beb94c5476e13477b3c583cfeb2449bb8a434633c561a9382a
MD5 950e7f638e8f1dd0c23bb61fe46a465f
SHA1 7648500c17d2b759d31a46d37729f6c12b1a7ff1
SHA512 7c6d77c32d977f1667e8df4abb547ad0bb9489ad9f8f69af5fbe7b0d1367a08a6fa39b62b1c14b35be347dc4e5d5d318fe17ca8c2c7ff3524f227dd25304916d
SSDEEP 98304:zSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLs:z2QSMXAmxSgzfpSr8pq
TLSH
T13746331472FADA647471ADDC7E7E5B4261F76424D834D76E82703AF3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 0217ccff19da170f27b3b6d2af66dfa0bf52041119afa0f4ef4c37c87faf3bfd
- MD5 24b4dc9903d0e93ab04e0d37115e698b
- SHA1 a5983023647632abed6fdb6a0e6a3b4b17f5c09b
- SHA512 a82e45db242ad5b0c3f519fbc08767e4bfd3c6243bef562130bc1c498f519ef57ecc4c2d5f7b4aadda54f1a59b5777845a370a014bcc3866cd6071277e3d23c3
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlt:8dCis4BEoZJLm4Kv8w+Gzerv
- TLSH
  T1215633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2