5aa528ff2a1210d4b8744630de563084927e5a8fc2dd11fcced3ac6503a9a152

General

Target
5aa528ff2a1210d4b8744630de563084927e5a8fc2dd11fcced3ac6503a9a152
Size 8.7MB
Sample260730-pt59dsyaje
SHA256 5aa528ff2a1210d4b8744630de563084927e5a8fc2dd11fcced3ac6503a9a152
MD5 4c2c6b802976acd81c061c4d91a075a0
SHA1 058cb023d20d512fcafb08a606d52acaf41b491f
SHA512 6cb7f0da6cf6eb3c065de96885a67463d028de8b7aa0ca0ad4a3edf1567145d45796d2630d97e75fd103544a7f5e2dfc033f75a3e699bd12e0e42279af51c12c
SSDEEP 196608:lfZnKBakl9olemMMdabGIark6onNYyeQaedwtlZreKTZP5TjacCYNMCKozam:FZnIll9gemCbGexNY+T6/sKTZPfNNt
TLSH
T1A49633283716F7899E099B1454AD86136514C38FC3E861AAE8FD357EB212BF091DF21F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal017.msi
- Size 8.8MB
- SHA256 d27feae64d5cbd2a3a7576f95f33f34694bb21f1213fc9f26873230c465b7d85
- MD5 04c58d20fec9ed10ae0d091dba2f05c5
- SHA1 5e14f1e6b8306279ca1a530957aefb68693b399e
- SHA512 1755d94495f7fdad48e26c015cf1bab5e4fe9306a4eb8bd1146161f62b200dbfc7fbc3a7c30aed9147a06500a28e44862b378bff277738f8210917e4a0a16b87
- SSDEEP 196608:Gfr5aBckL3Q52UiI/abgiWeS2+ZbpmguUeTsJlhtwUPdj5J1agAYXcyYoA8E:Kr5Y3L3e2UcbgixSZZ9wJArsUPdjx1XA
- TLSH
  T1729633943D867371E953CB308486B82D7D257FCAB3664C1B7D9D3A105A32770A2FA34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2