ab7b9204f617623131a0a141d0c29f061273500b31086c95b3975bd0e2110cbd

General

Target
ab7b9204f617623131a0a141d0c29f061273500b31086c95b3975bd0e2110cbd
Size 5.7MB
Sample260731-b4wwtahn31
SHA256 ab7b9204f617623131a0a141d0c29f061273500b31086c95b3975bd0e2110cbd
MD5 d202322e40cae7e42a97e807d36478d3
SHA1 cd85eeebbf4ba3009c53dab685528e7606c8e33c
SHA512 8d93b628e599593fb6077db3e6af2b9a0b80abbe78d720437fcb92346bf438c91a0669d85aba91b46794d1d29d8a7b4e69e42e868fff5eacaafb1ae4361219ff
SSDEEP 98304:epk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZK:epQ2t+vqHD9t2tbCvZdC6TQMz9BP0QXu
TLSH
T1CB563359A33E89E714F33FBD66858F35608EBA53BEDB890CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 0501e979875896d722630d092cd2d3a0af2c1b45324ef7f6e1a5affac79e2227
- MD5 8699b93e7716fe8434a5964aad08ea68
- SHA1 dbdf87e6564e0a698a4868aba64c24a5e6a36567
- SHA512 08acc988b4bc8bb6b74ab10f05da018dfab8373a6960d58b5cbe358b560cb4b4334ad73cdb99918750703a12aaba72bd28a2f4967a67023ddc77929659751725
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRk:3yOPsdq1N9vE1bPEiGut9HzgcPGY32KO
- TLSH
  T1BB563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2