bf99de62cfcaee2cb82aaf62853e4b854bc38ee3100ed46f8de0d767945dab6c

General

Target
bf99de62cfcaee2cb82aaf62853e4b854bc38ee3100ed46f8de0d767945dab6c
Size 7.6MB
Sample260730-hrj5tasgre
SHA256 bf99de62cfcaee2cb82aaf62853e4b854bc38ee3100ed46f8de0d767945dab6c
MD5 04b4a762d6287f54f3567f7f756d8270
SHA1 7afeabb142113055e9d028336bf44b497f559892
SHA512 e2ff28634954735f0d764078c60de3d19635749ae830f008f8f5bbc9f72ddfdfb2a2e8d010fe625d47f5fd51e445442d2e2a5347a1e810a7021cd1bf545e4ee2
SSDEEP 196608:cIriUd3n3NdrYv9Bj6UxxWh//dVUiK+rviQJ6AqxF:cIxdNaBjjxxWLLraQOF
TLSH
T1E18633AA7D1F0DD110045F4269985D3CFAB268D2D2189822F23D7A2F4E336399D77CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8005.msi
- Size 7.7MB
- SHA256 1bcaa176c2031cebfdf4d061e4a022950ca15eedd1b54d87b5357a5e8ff1bbea
- MD5 4378079e7d11a7b7ee064b9af57c6c8e
- SHA1 3b34cd18ab157d0972ebf016e43db962f907e0bb
- SHA512 ff4fbd33d6de61eb30deda48b23f1fd51cb95c9c5f7918f09f6fd3f6e1014f29952a1bc1ead7f41f95e05b0e52b95a160772b682c52886e831902195f8d146df
- SSDEEP 196608:ZBN9uhdNnvrjJElzusmWA1lB7kwKCtjE+Fc2GM:ZBajlEeW2nRo+z
- TLSH
  T1708633D67D8E1BB0C157CBB04246793CBE693FC1B6A68C12B36839141E337269A73758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2