46c990e66460a0117a85c50a1fbbcc37f73c68fd21ee5589a3fede9fe0e04214

General

Target
46c990e66460a0117a85c50a1fbbcc37f73c68fd21ee5589a3fede9fe0e04214
Size 7.5MB
Sample260731-c8faasvsd1
SHA256 46c990e66460a0117a85c50a1fbbcc37f73c68fd21ee5589a3fede9fe0e04214
MD5 ab33ac65347dab1c147826ca616b9a04
SHA1 78efdbdebc8555f6c6522802fe62d8352a0340bf
SHA512 8993788355638e0f2aa2098abe779245440ce4913b00b36a89f0cf0f936ad42be9410a061ce37d358d91d2f3f7d02d81617631dc8538646c2d61ee94d5991465
SSDEEP 196608:ka3yNZsWmE5G48H/fCQ9RhQLjZQj+DE4IALirOHbed:nuqWH5G4cf1KjOwIs3bO
TLSH
T1F38633E844EDD198F3B176864B83228D3F39E2A3538DEF6AFD5225017C953376B0548A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal004.msi
- Size 7.7MB
- SHA256 8c000ba7798834425295861755637cb072749e8b17f893ca528cd9bd30a65afb
- MD5 40d23c4b1fc07332708318a93e7b11a3
- SHA1 f43fe662284ad1cc629559b18310ae8f04b3fd03
- SHA512 cf8236f418975b5325d0a60aefa0713619dfe89169eeb0623ea0f9a9f39dc758d05a532ea31b644bd6a7be05d0a66e35cb1eadfd9b5928f9b9aa2c1bb97aa4b1
- SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrEC:yPKfBIe9y66qJ4CYmzrt
- TLSH
  T1628633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2