11ca14da52ece7c10ed364370ef3a398b8df8548a8d8ca78c46cf22cc768b8f5

General

Target
11ca14da52ece7c10ed364370ef3a398b8df8548a8d8ca78c46cf22cc768b8f5
Size 5.6MB
Sample260730-cvd53sxelc
SHA256 11ca14da52ece7c10ed364370ef3a398b8df8548a8d8ca78c46cf22cc768b8f5
MD5 f95f1858d602bbad88b6f3e48cf96217
SHA1 c837c77b86b17369de25134cbd37f9e4028225d6
SHA512 04db1b4f0f1439881b0add93cb62978361c2ed6da6fd3bd1675107c3a7db475535b35b48d8451f635c3dde42cb641736c5d18cf669b39da85465e9d51fa6c188
SSDEEP 98304:DSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLn:D2QSMXAmxSgzfpSr8pp
TLSH
T17F463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 7e025661b9b7d9d5bdddda2ba11387714cee722bc69868218c329ede9e3044ae
- MD5 06eeef5a4564b1fc45cf9f60cab2d8db
- SHA1 a144a52e641f2d0af63d86d0a49c35f5edd8cf3e
- SHA512 9401e5a5e9276dbfd36311a08b1aad8bb031b0b8eba3a2b4590137f5a2521612b5a6fd07c0f41eb7f03280d2ce07af6529e70c841d17b78eeb6b9d9896aad554
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHly:8dCis4BEoZJLm4Kv8w+Gzer8
- TLSH
  T1C05633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2