6df12f45b7f7642a1207b8bea17e1a813a27f5c3244596cdd1fba0f7eb50d1b1

General

Target
6df12f45b7f7642a1207b8bea17e1a813a27f5c3244596cdd1fba0f7eb50d1b1
Size 7.5MB
Sample260731-c78kfsvsdt
SHA256 6df12f45b7f7642a1207b8bea17e1a813a27f5c3244596cdd1fba0f7eb50d1b1
MD5 dd16fc430bf3a7334766a35e565e92aa
SHA1 04f14c10e582b114d5e8553bd9017dd74ad9092b
SHA512 84e741c27f291ec161500d65be147f4e5b207b2ba8c3677272526a90f7f57c5d05491cf2d4592a4b87fe6fe68f79aa87d6a737da521f548ced2d0644581b3849
SSDEEP 196608:Ba3yNZsWmE5G48H/fCQ9RhQLjZQj+DE4IALirOHbe/:wuqWH5G4cf1KjOwIs3bi
TLSH
T12F8633E844EDD198F3B176864B83228E3F39E2A3538DDF6AFD5225017C953376B0548A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal004.msi
- Size 7.7MB
- SHA256 8d929ffc08b282120eecc9aa708e6c2729910b86382cc34476a791e7c9067106
- MD5 31095a30951db93ef09502b41c869d09
- SHA1 3435c176c1de4e2b4177a1a91140fe40851fecc6
- SHA512 353499d8e59d6d152836e3eeb9146f83473b74d1a00649054470b8d8207248caaa72324c748876a49d189c651c7c3bfd1737840e86dfb17aabed208cc10b9a8a
- SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrE1:yPKfBIe9y66qJ4CYmzra
- TLSH
  T1208633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2