c23d6f7123cacccd398d254cf81aba0c9d34b64d79243faf2e7c99f7ab754a46

General

Target
c23d6f7123cacccd398d254cf81aba0c9d34b64d79243faf2e7c99f7ab754a46
Size 6.2MB
Sample260730-qxe22sbk3s
SHA256 c23d6f7123cacccd398d254cf81aba0c9d34b64d79243faf2e7c99f7ab754a46
MD5 d1e565a1e99558276e26e2730c36b56a
SHA1 27009b1e30314d5103f0d95b705faf2575e881ee
SHA512 ba4912902210fe6c3b20edfcab2b248d45eed996c21919ed8f056692f652eeeb4b3d826ba57e08c9bde52909d58327c54389465729e34f22bfc6383f163d1fac
SSDEEP 196608:+98JfdNJ5vnS0Kyv71NhyuL8UH20Oq62XCFp070TpMEhNqzp:vd7UUWg62Src9EhNqzp
TLSH
T1AE663344139B7FA2BDFCB9872000049B1091BC8BC9FABA9F5359071DBD146DCE56A8DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal019.msi
- Size 6.3MB
- SHA256 0def95242aea8245624d47df3fe95146b4fea9ed1a9d897735d5bebac8fb502a
- MD5 38f504d8a311176aae1ceea82711acf4
- SHA1 4137b284818f593fb47f6d449c468f968dc5660e
- SHA512 31ecd06c807f4c36ad0f27beea8f62f3dd7f89cc508cccfda6fe7345497a1613568aa3da3bb88c616eb77a190629d73c2e041c83c2ec5926980fa626766e3a39
- SSDEEP 196608:wP77rf9zSaKyh3gfoePcwEDgWOqYkNMFDUv0z/MaXB0l8:I7tUEwE0uYkKpyBaXB0l8
- TLSH
  T1AD6633C43AC63B71C59FDB76501224BE7865BFC6AAB70C0B33AC3B056D3321A6635295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2