73522422e18719c052345e7f0e1d9874ab852ed1a4fcc4ed32d1a6e0810d0166

General

Target
73522422e18719c052345e7f0e1d9874ab852ed1a4fcc4ed32d1a6e0810d0166
Size 7.5MB
Sample260731-c4tbcst1gv
SHA256 73522422e18719c052345e7f0e1d9874ab852ed1a4fcc4ed32d1a6e0810d0166
MD5 269426955a402c4c76f7918cd91aeb96
SHA1 ab97bfff5bcf001fe0a180b068db0237c3a58a98
SHA512 aa89e95d5ab74ad5aa8cb42c2dc64a5214645b2989fe06b918d774bac1acb4c4562093908dd5644c0dadeed9a44352c71f586b0b8193cb5d0d4b560f27b94233
SSDEEP 196608:pa3yNZsWmE5G48H/fCQ9RhQLjZQj+DE4IALirOHbek:YuqWH5G4cf1KjOwIs3br
TLSH
T18E8633E844EDD198E3B176C64B83218D3F39E2A3538DEFAAFD5225017C953376B0548A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal004.msi
- Size 7.7MB
- SHA256 c09b3459c67cfcf9571c9f782ad29781cc19e7cd2d2dbd08663dcc0f24b45901
- MD5 1193264e212fafeaa1cf07054f93c877
- SHA1 8880028abd0116f464c14ca740dc56f4014b6cd9
- SHA512 83d93419307c2a1fa7b9642d29eec99bd48b26930bba342eebb47ec303d4b3e4674df33dfd69c70c6b05225561bd37efff61327f4ad291cfb67644d70408fb49
- SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrEm:yPKfBIe9y66qJ4CYmzrp
- TLSH
  T14F8633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2