1f98bd4e880b2668fe6074b05578f437ad5692a0f1435e525451fc792bcd6462

General

Target
1f98bd4e880b2668fe6074b05578f437ad5692a0f1435e525451fc792bcd6462
Size 5.7MB
Sample260731-ay4tsshk81
SHA256 1f98bd4e880b2668fe6074b05578f437ad5692a0f1435e525451fc792bcd6462
MD5 0625426db310cde800eeda36ab4b8928
SHA1 6497a125be51fb221470f258bdb4efcb10b0023d
SHA512 37bf10f998d160a073b0273b8fa6cbb5ce05ae74028d4a57a4c05ed088ad1358968f64e4394a194ee54c16e5d44cbdbd02ec76bccf2acbc32c91fb387cbe476b
SSDEEP 98304:spk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZL:spQ2t+vqHD9t2tbCvZdC6TQMz9BP0QX/
TLSH
T1A1563359A33E89E714F33FBD66858F35608EBA53BEDB890CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 46e465caa8854a12ee70650f2b7dc0ccc37d02904caf68caf5d0844a9892482c
- MD5 60f33d80d00eae1f1a1d78de9840ea49
- SHA1 fb5ddef0d814fea16a1d36933ba70c9160f9ff07
- SHA512 54be25ee2e013a8c515154211f882a072a66722cd9fd9de693d77297042b073711dfedbe33649f4f5b88a93c943a9f810139a47ce9287301d4bb1a287a625420
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRb:3yOPsdq1N9vE1bPEiGut9HzgcPGY32Kx
- TLSH
  T1F3563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2