0b84fa2eafa47a18cc211380a573eed2e8066c7b46b9d485327ec21ecbdd2f30

General

Target
0b84fa2eafa47a18cc211380a573eed2e8066c7b46b9d485327ec21ecbdd2f30
Size 7.5MB
Sample260730-dnyrksyara
SHA256 0b84fa2eafa47a18cc211380a573eed2e8066c7b46b9d485327ec21ecbdd2f30
MD5 c5bfcdc060f83256928ca75bb51aab82
SHA1 5021907fff3099d83d4e92167b17f02ba11d2b2e
SHA512 650176e78430ad18f0443155b885589ec44775ae610c7f386f1432c6fd42fff89db60a9eb7c8547b5047d93dd61acfc53622dece2fac46db04800660f2729f81
SSDEEP 196608:lsaV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpYy:e1RCqd5v+0CS0AkKB
TLSH
T14E8633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 9b98dfccd992a7a3a3213aeecdb5d578e06c7a073b6f21e6362aa6644ee949bc
- MD5 4dfcb96ff3d59b2780b0f03c4704cc68
- SHA1 6916452e8e33d03f881029c05df6c7999342ced0
- SHA512 e430b3f20cfe62f316e36fc3110814b9fbe39afeb4a0571fe739bd59934606d525c9349c2a5775a407bc42419198d92e9fb38c3db7e6e5b8a37facbe35741882
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgi:xGSJty8TaCyLA+CkyZ
- TLSH
  T10E863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2