808bbc7723d40816aea160d95610ab483dae1402c6e30625e81d58f01991a213

General

Target
808bbc7723d40816aea160d95610ab483dae1402c6e30625e81d58f01991a213
Size 5.7MB
Sample260731-b2ejraag74
SHA256 808bbc7723d40816aea160d95610ab483dae1402c6e30625e81d58f01991a213
MD5 a8028625c4c70fdbcfa4ea5a68d54d69
SHA1 ad2a2e6b8772ccc189ae61da9e1c23c2de058e71
SHA512 da0a906913b1dedf77f37a00a2f273a2f723f9314fb9a44b16adc307a67761f8d20ec0455f079a9d14e051668c858e8ab6c9979d6b8785ab71661f5842548d51
SSDEEP 98304:npk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZh:npQ2t+vqHD9t2tbCvZdC6TQMz9BP0QX1
TLSH
T192563359A33E89E714F33FBD66858F35608EBA53BEDB890CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 f6911ab30e430455f4bd1b50655d62ce3b0e79d5096dda36bf75f53223e4bb47
- MD5 5152eb52d98f25c8b678db2564ba4c4c
- SHA1 651b8b489a134811f6dab44cad8502a31d4cba92
- SHA512 edf786091be7c9d8a2ba8038340fc0851fc60af030222fe04e56493f7c447bce6790bc3d948ab65d978b7072375326037d0a5004b7eaacdd70b1149422af18e3
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRO:3yOPsdq1N9vE1bPEiGut9HzgcPGY32KA
- TLSH
  T1EF563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2