00ada29a8741cc419a48bf2c3d71c6e8ad7892b404d20f077b0c6194cdbd93a2

General

Target
00ada29a8741cc419a48bf2c3d71c6e8ad7892b404d20f077b0c6194cdbd93a2
Size 7.5MB
Sample260730-dn4ylaah97
SHA256 00ada29a8741cc419a48bf2c3d71c6e8ad7892b404d20f077b0c6194cdbd93a2
MD5 0415b1a372b8856ee50dd665bc1e9e3a
SHA1 43f719b07afc82c351379b57399117c3ca750013
SHA512 b808e65038d9e283ae66f7a896200d29dbed6f949c24374b0ab0989d3fd249936dd84ffa573f11fd1f081166b6ad6a4f0542e767721eb2db664c6c131bd08503
SSDEEP 196608:IsaV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpY+:X1RCqd5v+0CS0AkK5
TLSH
T1F38633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 2509a2e1e0208bcf5a7192bf5abaefaf7a43186ff9b453d724b6a0a4b9cc35ea
- MD5 93ef769879558a362dd179421f82ff59
- SHA1 014822a5089c235d27fe2aad9916500e69977eb7
- SHA512 1b0d1eb030f4d5df2850929dcbfbe0a3358ac80d63e018dd393451868b1a3e3cbb2e294967aaef27864d40641663597056845b1cd8a2f4c5c144c09969fd7bb5
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgU:xGSJty8TaCyLA+Ckyv
- TLSH
  T19A863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2