fa33d91bd6377f84bb9d66b15223b34e25381bbbe345e3ff047526e93d518545

General

Target
fa33d91bd6377f84bb9d66b15223b34e25381bbbe345e3ff047526e93d518545
Size 5.5MB
Sample260730-v9kwaatejb
SHA256 fa33d91bd6377f84bb9d66b15223b34e25381bbbe345e3ff047526e93d518545
MD5 23d864787163dd78748f18ade4526ea1
SHA1 f96f1dce8d61777f9a9087dc19888e2b59b7e485
SHA512 5141610768a305b1fc3450b67e1f8155b735d3112d89eb00182834da0626bd1039b08d47832fbc6db015901007ec84fa25b247a59812144d51a9490eed4155b5
SSDEEP 98304:XwA+mJ93PKcZdMktrvapKAGFCA1vImpD+txs76LVuUz8s:AxmJtPKmdM+agAGpIef6EM8s
TLSH
T13F4633D6068BFAFA1F99BEC20D8891485B40F24E08DE282357DD9E15E7B4B533B79431
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal002.msi
- Size 5.7MB
- SHA256 eb5052623ea4187687d395b2111b06a85546929e621e382de28eca3718103493
- MD5 a7668e089f86b171186e697bff997fe5
- SHA1 6eef7755992b2fa7de01a26dff5734beeab005af
- SHA512 7c6e5bdbbfa5ac2ce53e29b247da18aec38f80af416076fe5ca948010522467094fb8f396cfd43b694e877491ae4f93fe94ade5922a64b330d006d4700931a38
- SSDEEP 98304:RoAyoF5zDA2Xda00MO2OiLg+Yjj8IcpLlnIjtGUPNzBrxABKrn4SBOP:O7oFhDAIdaTzUNej8In5GqAKEUOP
- TLSH
  T1335633C62DCBB2B4D047DBB10542225D72397FC94D6A8C1377ECBF1C5E72A22A976260
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2