6f8f76eb957260fabc7379a9255feafe39ddbca1af9d6d67d90d3139984cc67e

General

Target
6f8f76eb957260fabc7379a9255feafe39ddbca1af9d6d67d90d3139984cc67e
Size 8.0MB
Sample260730-pbnlmaha94
SHA256 6f8f76eb957260fabc7379a9255feafe39ddbca1af9d6d67d90d3139984cc67e
MD5 5de090cf1e38095d66084dee6eea407a
SHA1 4e03d92da510a98df0358561469791b01e7f927c
SHA512 9d83b22080116db44d7729eef507681c1d50d8b34bf3bf7f9453280a8ab0bd99b44515bf2cc617d16e574ee4852fa2747bd47da0a1956815f0f4d838e96e0aea
SSDEEP 196608:ssg7STKc4UPBjLiwlhhXcrwirqn5d1QzU+mEVHw:ssGc4gl2Khlcry5d1QzPw
TLSH
T1EE86332E3524E7C0CC0A591C94B546B65320A5A92DF21F7EDA5A0EC892338DDF37D63E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8015.msi
- Size 8.1MB
- SHA256 789c00cca09ca1cb3ea6a1f952f94861dc4c18b1b6bb099a50840b0506c54576
- MD5 b8a416e8d13596b3d02bc2ca32c98061
- SHA1 93fbf8644a74dfe205c795b841b2f2c29ecc59a5
- SHA512 2dfdc63e7692ee374ef17e0be3f69cc9b0dca88770a48eca3f41497129c0c5e7c09ce74eb33af2b4ed1150af7044d319967a261e979fdee74c3b1743e2087ee8
- SSDEEP 196608:yd86DijwQuo5dL7W2loA9nEY/s7ldnezAQKC1zs:ym8Qu2picN9n6JdnezFs
- TLSH
  T15F86339A78CA6370C44BC378814276AD72287FC93E760D0AFAD93B4C5E33A55B179319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2