67c10c4f13d37a6d4e5623963c3e3f897eee035c59a06682e5ef92e443819114

General

Target
67c10c4f13d37a6d4e5623963c3e3f897eee035c59a06682e5ef92e443819114
Size 8.0MB
Sample260730-mpfrtswbpb
SHA256 67c10c4f13d37a6d4e5623963c3e3f897eee035c59a06682e5ef92e443819114
MD5 1114b64c37501d0fbfca80268af61f2d
SHA1 13c100a57419d39bd71e390cbfb6325eca8800b2
SHA512 f8b3bcab49410de39cdc2deb071b1ed9fbb0498edbb436d58cbf2beff938b21b985c54594539836adb2ad33e01f3774e8219c437390143516dc36d8d1de1e20c
SSDEEP 196608:Ko9i3h3RfTuWjY8FAxju7PIsxozD+HQt82mfidHFTHg80WU:M3h3RCWjY0Axi0QozKc8Xfivp0D
TLSH
T1AF8633D31F496949ACF726B3C236C9D2E86748105416FCFD4D12062191E36E73AAFBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8013.msi
- Size 8.2MB
- SHA256 d763d308471263fd18c286c3b30d27213efb5686ce504d7d5da0fec9c2d7efb0
- MD5 2c0deef89c167d74e1771099fa8a5761
- SHA1 9a1f9f0bccbcc143f68d65ba5ddc7ddcddb38867
- SHA512 77a957d255e7b52345a28f618bcaa4056598e7e96b0601183928fc677464bc4af9bf1454f92d2836422bb0fa56447e78a90237f54d6b68d1fbf9e2dd6ec55498
- SSDEEP 196608:byxihcXiX/VIAjY2Dyq6s4szfonC7E+CrwT7hzFmbwsL:bs96uAjYGyq6rszQCEvrwbA1
- TLSH
  T11B8633D27DC93770D49BC3B14123AAADB03A3FC0BE368C5B67993610597362365BA742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2