cc18fb093aaf1226df71b2d0c3024a600866cbbb9f0d92d6fc1cbd3265657a50

General

Target
cc18fb093aaf1226df71b2d0c3024a600866cbbb9f0d92d6fc1cbd3265657a50
Size 5.6MB
Sample260730-clmqvsxdmc
SHA256 cc18fb093aaf1226df71b2d0c3024a600866cbbb9f0d92d6fc1cbd3265657a50
MD5 8d71201239f6073df4d38af497fa77f2
SHA1 a20e90ab8f0b31c623690482d903a75514450339
SHA512 2e15b327782ed3972c71faa62dbb016d25cddde7cc847611075007385f9c99eaae0dec7cbb30c914038d3d3af22f5ceeccaf22cc62e8c5c0af1d9e87343a7287
SSDEEP 98304:NSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLS:N2QSMXAmxSgzfpSr8pU
TLSH
T165463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 92b3bbe230a577e7a935497a5545c97fe219845d55ab52fac9b91ece028daea2
- MD5 b8b6e434188332ed2f5db25aca66b0a2
- SHA1 7a307fb38557e20dd1f9396b41bb39ae72d06c76
- SHA512 474f4de0c9d377c1c120250f5f4c5aec6f0a35ec08e889044f20fd770e49caf8629a779bb095d99ba6f17b737e691565fe5ba3ddff5c0ee18aa59214285f492d
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlK:8dCis4BEoZJLm4Kv8w+GzerE
- TLSH
  T1E95633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2