c9b19e303f32cb9b1a8a95d8d1acf756c8e0029c08e1589d0eee7976d836723a

General

Target
c9b19e303f32cb9b1a8a95d8d1acf756c8e0029c08e1589d0eee7976d836723a
Size 5.7MB
Sample260730-v7rk2sda76
SHA256 c9b19e303f32cb9b1a8a95d8d1acf756c8e0029c08e1589d0eee7976d836723a
MD5 4c54de900da3606bbf532d6bb75ff1b1
SHA1 02dc5b9395bdfd77eec809b5eb971390af6b01ad
SHA512 06f8e8f3cc63e22b1cd48a3c4da360733c1fc8ca3366948e09a30ad1fa95b57919b72578023614895b240c814668f39050eb2bfb4d7c3eb33d7795af22e0176e
SSDEEP 98304:4pk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZf:4pQ2t+vqHD9t2tbCvZdC6TQMz9BP0QXL
TLSH
T14E563359A33E89E714F23FBD66858F35608EBA43BEDBD90CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 d091c6d5a915f8923879d05f833c0a7e7bc3894f8bee3baf01f07d58c37adc5c
- MD5 2c6dc8510f588e378193b67ba49fc3c3
- SHA1 e38e454d30e5c7aedbc3b565c5a782f6ca5b7767
- SHA512 c23285e418d4a93b004341f3f85b7c52b8b1df52ccc90739d58fd440c89087d2f5ee03e271d2b4cc5b0296b48848ae11f4365f2349a51f71a4d203de60050a25
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRk:3yOPsdq1N9vE1bPEiGut9HzgcPGY32K6
- TLSH
  T140563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2