5b6fd7d288abb7137a30336c223e8708ceb21e04f035dc37d1982ff165dbdc7b

General

Target
5b6fd7d288abb7137a30336c223e8708ceb21e04f035dc37d1982ff165dbdc7b
Size 8.0MB
Sample260730-mpgdcszscy
SHA256 5b6fd7d288abb7137a30336c223e8708ceb21e04f035dc37d1982ff165dbdc7b
MD5 2f3c273cc710e5acf8982eed9a1c678e
SHA1 44db801b9c057f17e17c282720cd96ae7765cbe0
SHA512 898e5f811b5032a53f4b3d1bdbd2b0aa87aca2d801afa5fd04e1eeeda05bb914d3e5f32eb4f3904d2312d681f929cbc2184fe5d254892210351c1a216f924853
SSDEEP 196608:Qo9i3h3RfTuWjY8FAxju7PIsxozD+HQt82mfidHFTHg80Wf:m3h3RCWjY0Axi0QozKc8Xfivp00
TLSH
T1B18633D31F496948ADF726B3C236C9D2E86748105416FCFD4D12062191E36E73AAFBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8013.msi
- Size 8.2MB
- SHA256 0da9464a263a9a48f669bf10f054505e5e22ea1dc04affd25c947c167517ebcf
- MD5 9531ecdfc1557fe88bba5ad522fd7a2e
- SHA1 734914c7890a9d8570f58503b9393232d52cf46d
- SHA512 98fe2ab68c76baa3981c650c79bab2b0bb40e93631d5446eccdb7788ec60e6860165fc8570a408056fb257c619cd8f3ad0e2b52ab4b672895c3939155ffb54f9
- SSDEEP 196608:byxihcXiX/VIAjY2Dyq6s4szfonC7E+CrwT7hzFmbwsu:bs96uAjYGyq6rszQCEvrwbAQ
- TLSH
  T1EB8633D27DC93770D49BC3B14123AAADB03A3FC0BE368C5B67993610597362365BA742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2