d294b0ae0f4b009230f1754e04435da0c9fa401ddf4d5b8b2edb49bed2fdc254

General

Target
d294b0ae0f4b009230f1754e04435da0c9fa401ddf4d5b8b2edb49bed2fdc254
Size 7.5MB
Sample260731-c678asbe58
SHA256 d294b0ae0f4b009230f1754e04435da0c9fa401ddf4d5b8b2edb49bed2fdc254
MD5 8f4d07472d00c5f5ab09bc09d7991da1
SHA1 c614f4d8cbdc794a967b602ebadce31b999c61f4
SHA512 15036a75bcaef5cf3ce470158cb023623473bae661782028373743c9e411d32048ff02101a843138237dc29bfe3b7adbd49d8641b34014298865e2d8c7c9a439
SSDEEP 196608:ja3yNZsWmE5G48H/fCQ9RhQLjZQj+DE4IALirOHbes:uuqWH5G4cf1KjOwIs3bl
TLSH
T1C98633E844EDD198F3B176C64B83218E3E39E2A3538DEF6AFD5225013D953376B0548A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal004.msi
- Size 7.7MB
- SHA256 97890766d56d952fe6242bd5dbf231113c2c3335f4994b659e485e047ebfda83
- MD5 1b612e553f5fa50047d236cf19fd2dcf
- SHA1 4d83dab0854d79e77d3ecdfc99850f6b7b391b3a
- SHA512 2ce2fc0c200e9d7743f686bf22cd338413035b829a6e91d74b88dc094f36c1a4701eb6101021ce59878713d1cbb8fc93a389758822b232b845f7bcd0d7097d4f
- SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrEt:yPKfBIe9y66qJ4CYmzrC
- TLSH
  T1508633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2