6839116d3b4293bad51946d3c7d64d071a488f6d116dfa2e5e6e72e2722de99e

General

Target
6839116d3b4293bad51946d3c7d64d071a488f6d116dfa2e5e6e72e2722de99e
Size 5.7MB
Sample260731-b4t28ahn3y
SHA256 6839116d3b4293bad51946d3c7d64d071a488f6d116dfa2e5e6e72e2722de99e
MD5 e6115891aca77caec21fe1e1fac752d8
SHA1 bb00a2f8d0df543e73054a72469b3eb64a69b0aa
SHA512 94a28400363110e7a72fc364c1693917a9a7b069ef9ae16f0b370a7d77e3b16927fa66ecd9d1398f56f5424cf4481be2c92b1aef2c4bfdfaf652dd79f44384a1
SSDEEP 98304:Qpk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZW:QpQ2t+vqHD9t2tbCvZdC6TQMz9BP0QXK
TLSH
T116563359A33E89E714F23FBD66858F35608EBA53BEDBC90CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 a3bab62d2b1deef2f50a85c4cee2311691ab1b5222907f3a237faed657c3892f
- MD5 3136f54d3b93e06787cf73dd5493bf4b
- SHA1 e439bebbff5b89a23216f2348f60bfaade88c87f
- SHA512 2a4e84e176ed82a3a9a7f34d94f1db6b3f22b94c2cb21a1dd66609ee17c51e9f4bad225288c4aa31464d38f93e7d5651250fc758460fda935be7a65285b98cdd
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRO:3yOPsdq1N9vE1bPEiGut9HzgcPGY32KA
- TLSH
  T17D563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2