69fb5df3009e817b84d0fc6ff6d091e767c0cc2698379fd7b89bc8001acb12dd

General

Target
69fb5df3009e817b84d0fc6ff6d091e767c0cc2698379fd7b89bc8001acb12dd
Size 5.6MB
Sample260730-cnes2axdpd
SHA256 69fb5df3009e817b84d0fc6ff6d091e767c0cc2698379fd7b89bc8001acb12dd
MD5 bab0650a7e94c099fff06181aec4b34b
SHA1 20d711a944c73c8d8e069103751b48e2ddb64235
SHA512 898b903963c22c7e618e13225a92d322bed61206fc3221bbff2ba27d29b39ae5b587b1b3f6a3ae789541353955e85c09e4130b64d2e2742e3f84610772f390e0
SSDEEP 98304:ySXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLp:y2QSMXAmxSgzfpSr8pz
TLSH
T1A9463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 c934ce2e4f8cb4f165edecb51d91390b00f5084809bad25c0a5a189271fa5fe8
- MD5 46fcdc786df0a6e837ca97924579d069
- SHA1 c99f0df69ed9ffb9e77b6757df6347ab6540d5a7
- SHA512 16c3e24e49e10ca11db64f4a98a77b8d5b33e36bd0c591fb35e205a81c04d08f89377c9455bcec7d5daad553f447bad1d633435a6fdcde3237e720c65d0eb919
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlX:8dCis4BEoZJLm4Kv8w+GzerZ
- TLSH
  T1A05633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2