9d0f6841a96212c10a67fac1a567130a901cde955101470c4d70ab4227410388

General

Target
9d0f6841a96212c10a67fac1a567130a901cde955101470c4d70ab4227410388
Size 5.6MB
Sample260730-cnf14abm8v
SHA256 9d0f6841a96212c10a67fac1a567130a901cde955101470c4d70ab4227410388
MD5 0be739973a41ac868ba17d41bc400456
SHA1 9586a28bf29c6280215ac8695b5561c1e269897d
SHA512 e0bdf97643906ae4887ab57ed640e94dae7b25af1cfa33c1ffea4e74200f367252fee3c3b6d6680e680f8aaced71ed3ef3700640de5e10ebc8972dfd19e13e61
SSDEEP 98304:CSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLv:C2QSMXAmxSgzfpSr8p1
TLSH
T163463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 a3ec1c7645a9466472ab8d1a0472f852a00b6b762ab5f73dc84695a551bec1a6
- MD5 39f1cc4f182be82c6375bbab6ed2fc4f
- SHA1 7770109b9f0b8a67d4b2ae1d67b5fef5b41fecd1
- SHA512 f550ecbe74f760e17988feb94763e87776a18fa969422efd825ff6e8ddc9a39fc374028ae705415436fce45b73f70deb1a5cfc6e61c0e6dd7f47862258b1e661
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlK:8dCis4BEoZJLm4Kv8w+GzerE
- TLSH
  T1B05633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2