72372279c0494cbf8376bda68b6f217c24f7e5bc1f79b1889a127dd43a5d8142

General

Target
72372279c0494cbf8376bda68b6f217c24f7e5bc1f79b1889a127dd43a5d8142
Size 7.5MB
Sample260730-dny3cayarc
SHA256 72372279c0494cbf8376bda68b6f217c24f7e5bc1f79b1889a127dd43a5d8142
MD5 a0256398b5b32e28a411ec942eac5629
SHA1 6f552519468ef881861d2d898b3aec18b97c995e
SHA512 fe4f79024b593d176a6ee44fa4a3f4e4d2682bec12f9c4ade11cb763f4981d606b1b878378a45099814e083e386b2a888dbaeef653153e345398b3a594432f27
SSDEEP 196608:csaV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpYN:r1RCqd5v+0CS0AkK+
TLSH
T1C48633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 56fce28881a96479d0d8c25dd96cc65ca45bbaeea786d4c9e26ada6cac2a6975
- MD5 0d9e0c6eaa6c6ca10f072e2ab4c4b05f
- SHA1 1b2a0dfd028d3d9df2c3c77cec37ee7b2df2b76a
- SHA512 790e49c1e93088a7aaf21c5d5d851ff92e99c52aeabddc357e3bade483c9d35ea1d91c6aeb5315a7018e51140f7008e4542eb1cf92ce32bfe8eeb5ff0c4d9dfe
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgM:xGSJty8TaCyLA+Cky3
- TLSH
  T18E863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2