b9430465100e90f0c38cd3e0d3ddefe5a49178e1ad8e07507fa390050ffddc6d

General

Target
b9430465100e90f0c38cd3e0d3ddefe5a49178e1ad8e07507fa390050ffddc6d
Size 5.7MB
Sample260731-ay4tsshk9s
SHA256 b9430465100e90f0c38cd3e0d3ddefe5a49178e1ad8e07507fa390050ffddc6d
MD5 684d57163a20787a1a93f6fbb96d19c8
SHA1 352c6a94d25963d8f66d7c732e9a8c891280ec80
SHA512 07fd3a9c3089111977c2bea972cd04da84b4bca1848e23379b3fdf5c1f6f24ca45cb1931a0be8d68e730e81d01c1598b8d0608254066a0e9dc155da8bb945fcf
SSDEEP 98304:Epk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZO:EpQ2t+vqHD9t2tbCvZdC6TQMz9BP0QXa
TLSH
T13A563359A33E89E714F33FBD66858F35608EBA53BEDB890CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 770526d055f21b6c3e4799fad88d357ebabc6774f81452952f51aba3a05fa817
- MD5 47690112f7254e72888682e69d3203b6
- SHA1 f8c90372e4b03f79970e02f421dba121cfabbe8f
- SHA512 dfcffd3ade9cb45e1d37e379ca7201fb4132be3ce0bb6ceabf1a5cbb316cd697ecf5fed1a0698fa6f94bfb200321f7810e7fdcbaa78de01eac0d12525c361f39
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHR0:3yOPsdq1N9vE1bPEiGut9HzgcPGY32Ke
- TLSH
  T166563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2