1527731a759096180e2c8c10b72387bc6f85a0e6d9a7a502e8dc29998feb84b2

General

Target
1527731a759096180e2c8c10b72387bc6f85a0e6d9a7a502e8dc29998feb84b2
Size 5.7MB
Sample260731-b2ff2stxfz
SHA256 1527731a759096180e2c8c10b72387bc6f85a0e6d9a7a502e8dc29998feb84b2
MD5 6518228eae259fee4107b7f3fddd5178
SHA1 120fbd1069d2417f52a41d69817d2994d0940f66
SHA512 684742dba536fe8adfac34e1cdbfdc82926c5bc43b55b011b0ac2e997f16204b6eadd1340ed94d5fc35d33bccf10c5b2ea23aee1b1e2598e09932daaa4cadaa4
SSDEEP 98304:zpk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZT:zpQ2t+vqHD9t2tbCvZdC6TQMz9BP0QX3
TLSH
T151563359A33E89E714F33FBD66858F35608EBA53BEDB890CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 73485662dea3fff3fc7085555db1d98c7c8e0b2711a59010dee095c9da824257
- MD5 15737aa7974d705bd37215b087a50194
- SHA1 7f5b1dcb0c8fc59142d2bbe6df9fde24666435e6
- SHA512 9d2049a6560a36482a5bbdb752e33e2dd4c4869e56721cffe10607f63a3766b7f4f71f664ae198b6307c06f5ea8f12cd9b22fb576ded97a6867a5abf57db6c10
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHR2:3yOPsdq1N9vE1bPEiGut9HzgcPGY32K4
- TLSH
  T1EA563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2