fc2864a2e764e9e6f0d58f8404a4c8da7ff7778338bbfb9cc3bd130804ca0a0e

General

Target
fc2864a2e764e9e6f0d58f8404a4c8da7ff7778338bbfb9cc3bd130804ca0a0e
Size 7.5MB
Sample260730-dnzc4syard
SHA256 fc2864a2e764e9e6f0d58f8404a4c8da7ff7778338bbfb9cc3bd130804ca0a0e
MD5 f9491c0e9e913790f2bfa8ac5d63104f
SHA1 1b095b6f70404f8d501a2d44b8c04b4d7d21cd9f
SHA512 afae6268c5dfbb1e79f6093323e608acf80ea03e9577f8073a4edc0c5eaf2aca6c20719d9353eb7b9c62c28a7700ffd8bab384aa9aba8e3249196bcb71ef2de9
SSDEEP 196608:qsaV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpY2:N1RCqd5v+0CS0AkKl
TLSH
T1AF8633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 3216f0bd43b801aae780cfae53376945fdf0a8ef4e7df4ae96d43d335f2b578b
- MD5 d50c3413716fdd45591a86ccb58a0fef
- SHA1 7836d4c1bad9973c6f4deb5b4f01306f60479b6f
- SHA512 24633d5dc009075a53552824e2678871f189d8e0d7233e2ff18566b4d3f7e2b7d1582661dac24a1d9e2357f7801f1c4adc3fa59fd87a69ffa95d5697b7ce6eda
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgE:xGSJty8TaCyLA+Cky/
- TLSH
  T176863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2