7d8e0648170b1f798116d640a07dd4c1f19cad4a0ba0b495a7fbeacf145fb9b1

General

Target
7d8e0648170b1f798116d640a07dd4c1f19cad4a0ba0b495a7fbeacf145fb9b1
Size 5.7MB
Sample260730-ycevjsef38
SHA256 7d8e0648170b1f798116d640a07dd4c1f19cad4a0ba0b495a7fbeacf145fb9b1
MD5 eabacf19b7b7d118ade6cf7b8ce12754
SHA1 2fef05a284c8a6a6c88fd8855b892b8aa696ff76
SHA512 950b46d964a9c4d2181c66230ae1491f74fdee240ac9da24bf2e144663ab1d40b479bcefd5656a3d1b66fa583f63cf38c90cce0a27a2b5316bb883b00a00c948
SSDEEP 98304:cpk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZz:cpQ2t+vqHD9t2tbCvZdC6TQMz9BP0QX3
TLSH
T1E6563359933A89E714F33FBD67858F35608EBA53BEDB890CC435AB32C518252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 acb8343a0da89698d6f9401d7d81f000b00c36658315eb4dc997beb5b722e988
- MD5 025758c10a53914fa605e50564de4a5e
- SHA1 3dd5d7ce2ab1cbe7a8d5a82b3e4ec4b54cf82c31
- SHA512 9d1f5c0f4130b18a1c256b5356f60a62650893950241a4fa974a032667332cd69f60abc2f9d567a77158a499a887666c5fe5c452efdd38ad70868191b90e2937
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRf:3yOPsdq1N9vE1bPEiGut9HzgcPGY32Kl
- TLSH
  T1EC563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2