de0c1079cb4d942effc1e5f17ae9cef6989157786771d868235520346c23ee32

General

Target
de0c1079cb4d942effc1e5f17ae9cef6989157786771d868235520346c23ee32
Size 5.6MB
Sample260730-ctsxvaae68
SHA256 de0c1079cb4d942effc1e5f17ae9cef6989157786771d868235520346c23ee32
MD5 f0aecc89b935cb7e3f65f505b49861a9
SHA1 836d0edf14b01582eff1d3011197df76e4e1b653
SHA512 506727397d7af5eec566e1a778a34aaa889c84fef79b02038fb5eccd501d98fe624e6c3deccee053678c380077ad5328474ebda0ac3cfbba7a25e4159d95d89f
SSDEEP 98304:/SXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLN:/2QSMXAmxSgzfpSr8pz
TLSH
T13B463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 f76aec724d73ee0c4e3bb2a7a50c064b5e6d6ddec54aff95e50c1e54777d0414
- MD5 1a3614357817fd3ef344feea11368aa2
- SHA1 5e8a944343ae556ef8abc62d7aa8ff1023255669
- SHA512 85d44681c4a6ee58195e07d55d889ab97566848493ad1ccee4e90d9c2a18cd1e74f1a17c4a25dd24731f042ae73a20472fdd2a9c4741197e1cfc91733e5dc539
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlY:8dCis4BEoZJLm4Kv8w+GzerW
- TLSH
  T1455633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2