31e8bf5c91d9d47dc5d51cb4f2d3165b1181fbdf3efb2a07d44f2cb4adcf6234

General

Target
31e8bf5c91d9d47dc5d51cb4f2d3165b1181fbdf3efb2a07d44f2cb4adcf6234
Size 7.6MB
Sample260730-ke41kaed54
SHA256 31e8bf5c91d9d47dc5d51cb4f2d3165b1181fbdf3efb2a07d44f2cb4adcf6234
MD5 e37ab9aecdec71de55d66369d5e397c5
SHA1 f638c199f05b8e1310a0d15312cba53f5ef0c1e7
SHA512 2eaceea48b8ed35c800b8eccec666fda6cf281117db5fd04efe4a60de703d982ba76f682248308f3858ac688e49a0816ddf82d89275c6a18a2483a84da4185dd
SSDEEP 196608:7IriUd3n3NdrYv9Bj6UxxWh//dVUiK+rviQJ6Aqs:7IxdNaBjjxxWLLraQ3
TLSH
T1D38633AA6D1F0DD110145F426D981D3CFAB2A8C2D2189422F23D7A2F5E336399D77CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8005.msi
- Size 7.7MB
- SHA256 09f74e1b7353a5592705745b9c7c97188affc1659cea88d996d2d14a0e534058
- MD5 399cfd0f60ec4dbfb21aee005fa2d64d
- SHA1 2bcb85a83f0760038c5794177bee0a04264d2a2a
- SHA512 74bbd0ff40db092d442e1b1846a7b4826a9a5c665a632926a8f53ad79e7b8fc153da22ebca8febb1fdd37204e8c9801b7708090f93315414cdc361449b03c133
- SSDEEP 196608:ZBN9uhdNnvrjJElzusmWA1lB7kwKCtjE+Fc2Gz:ZBajlEeW2nRo+M
- TLSH
  T18D8633D67D8E1BB0C157CBB04246793CBE693FC1B6A68C12B36839141E337269A73758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2