5caad396e29205f9fe50e15cf2a16adb1963b62812a087d7865ad6c321e7542e

General

Target
5caad396e29205f9fe50e15cf2a16adb1963b62812a087d7865ad6c321e7542e
Size 5.6MB
Sample260730-k358jaeg68
SHA256 5caad396e29205f9fe50e15cf2a16adb1963b62812a087d7865ad6c321e7542e
MD5 13e2b3c597386037097b57f130459230
SHA1 f7076cb7e5cdc400d626d9d4c715a589a1bffece
SHA512 1aa464c4dddee5ed8f628797f68653859228719cacb7196e3ed2ce8475a26f0bd5ec6b61409c6762226fd1b61cafa173b0bdbb011bfc5983b571918cb1a4e6c3
SSDEEP 98304:o5P59v/23FLRDPDK0J1iUbgtFJjV9nPJIXJM0J5WHI+9vlhrE0owuHmuZd0m/1Ra:o5R9v/gBRDrK0J4FjV9ni2Qb+9frtuod
TLSH
T1B55633F706A5D30649558B079C28727E8F44EE86D7FA33269F767AA32469403C93E348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8006.msi
- Size 5.8MB
- SHA256 d2f2ae95dfe5e3f889b0e49c9f496c49bb4c86af4b4a09a633c33b8fbf787b16
- MD5 41e72ed024ecbe7bc70b74cee26be4d2
- SHA1 66a2c0872064e3476eb62f539587ea52e8b5acff
- SHA512 37c9de9d1b7dbda9691b175534c1559601d56b7a9cd28f91ef00d1808ae02992d92d10c435ec49af0ae2690e0b7cdb9097447ef0fdf2544afbd0d49c1c4f3ef1
- SSDEEP 98304:nojXur7EW9pPgeT1iQLgJF59RVzPtI3zOsXluHealD1qa52o8Mg4OFDSq/bxpqVR:nOuXEW9pPgeTyB9RVzeSIFalDlEo8aO+
- TLSH
  T1155633E63ACA6335C06BC7798051216D72583FE19FB98E263FE9371E1C73506587A384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2