ed0cada9633116c5e2886f09db5767e90bdb9209acf88167ae34c156cc878ca6

General

Target
ed0cada9633116c5e2886f09db5767e90bdb9209acf88167ae34c156cc878ca6
Size 9.7MB
Sample260730-ll6y6sfb84
SHA256 ed0cada9633116c5e2886f09db5767e90bdb9209acf88167ae34c156cc878ca6
MD5 c7ded8a7ae1156480dad6f867cc594c1
SHA1 f2cd55472e03acc482c0835ef14181f5adfc5fa9
SHA512 1b4fb269cceb371fd06bc44dc522847746abceedc86ab8ad315e5e70b6ef389f7489d983e47739636e4682f5b7c94c005e6dd519fdd170abff5ee26a24c8e0c2
SSDEEP 196608:SBjE9dxwvroDXrz5zxJPhyBln5Oi6cu/MRCrEe3Z5iN4lgW6S2sD+RQVmih:SWxwDGbz51KXJup3jc9bswuh
TLSH
T171A63342369B3802B137720EF1E0D99E65B99D47E65B9163BC9FE484ECD35AB271CC08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8011.msi
- Size 9.8MB
- SHA256 c8bc5b56d26acc7ad6bda82319826966837867e2ae6a28c8aa5d5543917c9544
- MD5 aafbc24883107b4ff306d5120fc0b2d6
- SHA1 0b66f31bb2ad21a3d18196e4f330c290692044a9
- SHA512 d30bfb006bae714709a786afe2cbaa0ab344f1ac730da3b27300c9d7d69c97ecc3529273a009687ce5db9c38badeef6f144cfe2a53c65ff8fdc7c21fe254a06c
- SSDEEP 196608:Nsz4tlWBdX0N/o3uQjr9OBHCB1nbm0CEMJQRU9WWZF1EDC/SIzsiwPifQx4uyN:ezXX0xAt9Rj1MlZbMsbKoAyN
- TLSH
  T1AFA633C17DC72371E01BC376E181A5ADB13A7FC3BE228C1B7ADE75049DB222651B9A05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2