6da87042bd59e0df03a24aa0d39a45b0ddbd7e7a8fce3893744d8bd7cbeb8902

General

Target
6da87042bd59e0df03a24aa0d39a45b0ddbd7e7a8fce3893744d8bd7cbeb8902
Size 8.0MB
Sample260730-mtsxysga93
SHA256 6da87042bd59e0df03a24aa0d39a45b0ddbd7e7a8fce3893744d8bd7cbeb8902
MD5 a89b814d94001a1afe2d7b7d87edb0b8
SHA1 4615d2fd70d91e10dd69e2165fc2bf9247f8ecbd
SHA512 319ff14a45409f8395f6db19aca858ca19511c725858a7db3cf08b1a63629c91157d9b61a1397767ed5b3bf8d3e4eea104034ac426c23fa2d46eb39596e107a0
SSDEEP 196608:RnAMawJrTWE0ByzXAVywFgWlEnrz0edWw:RnAMXJrTWE0Lk1r/
TLSH
T13C86333C5A546865BA9F9B250DDB8CFCA6E7401B0ACC501FC690F4FD81292B0E763E76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8010.msi
- Size 8.2MB
- SHA256 04f674c805fdb491201194cd0775e8a7ede971ca8022061b0c4c4b539a464656
- MD5 031a8de6ec68db4a3c6af64afc9e6887
- SHA1 51d9a0dd35d293ae67d3f01c1454c5d431f5f2df
- SHA512 6c7d3369415b33acfa7c2a55f7a4cdb6242ea934e1a0458c02e9cb39d3ffbb8a2882aaacf15bd25993c96f81ac78dc10beaabd8b20e211ba20319445baaa544e
- SSDEEP 196608:oi/kBKcW31fCu3FlmzLyr2sRk0fGfB9Wevj:A231fCurqnBZ
- TLSH
  T1738633647DC52B70E08BC3704A8399BC71BA3FCABE6A4C0767D57A4C1E35224A5B3725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2