005e0eaeeb0d58bdb6cb2a0c92bd62e1968ceed70edb3e8682d6d52ac2dc846f

General

Target
005e0eaeeb0d58bdb6cb2a0c92bd62e1968ceed70edb3e8682d6d52ac2dc846f
Size 9.8MB
Sample260730-p3b2xaaq2z
SHA256 005e0eaeeb0d58bdb6cb2a0c92bd62e1968ceed70edb3e8682d6d52ac2dc846f
MD5 6030ef449f0f2ff27c8f0bf174c45783
SHA1 58924b14cf76eb01792266f7a64e07aad3b599b0
SHA512 8deb83189e145126e1545ae4f309f6646106d00a5bdbab2c5b46f2e3888ecd8aa1ff468716e61c6c3219cb51800403136bb14408201ac3304a80994492ea3380
SSDEEP 196608:iRfYLSGo6bli/0eC1aJwckzsNpGoi5YFOyBzK2q9V3C7Z7c5YqD7+2sGFO9JEkBl:vNoyM/0h1hsSoi5YFBBzM3C7Z74O9JXj
TLSH
T11DA633F78B4A0F5703C64E1AE476D981B97B2A59F2017A3CFA9AFAF1B13815D0034476
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal016.msi
- Size 10.0MB
- SHA256 b0b27f557bf0735187b60b1d8bfb98a2bae8db3c8144927b03b91f95b89d6226
- MD5 ec14a71d73aa087b87448f6ab8efc6f4
- SHA1 21943b73427794a6a7f506d40bc1a897b3438648
- SHA512 853908a9919952c55603c0131f85517b7fd385706f84f69e00045311cb8e619ca171a57128bb65a3fe206aa480a28aac4fd7338620a69696f8f322f59b0f7997
- SSDEEP 196608:0V2vIbC4Kc3/Q1k6keUnODNrgSiTARyGt3K6UZfR+rHb0tYKx6+yWcbC7D6CxrIe:Yj3KUI1kveJDKSiTARnt3cR+rHP9C7Dv
- TLSH
  T105B633D5FEC617B6C18BCB748153E59CBD3A3F06F2125D2ABA8D7A50393222E0335256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2