6a0b30a23ed2a9144bc90d4b94fa34416af682098e45689b6661f1ce719f7476

General

Target
6a0b30a23ed2a9144bc90d4b94fa34416af682098e45689b6661f1ce719f7476
Size 5.7MB
Sample260731-dav4jascpb
SHA256 6a0b30a23ed2a9144bc90d4b94fa34416af682098e45689b6661f1ce719f7476
MD5 fc6db4512fa39a24a2ecc8c3854d711c
SHA1 8f62c236077ba02adf75ab42c943b055fd1cfeaa
SHA512 a86457e896af00d0074f06d4dc51f7a54e67213e282b480f472db27a7fcafbd60de376805dca96a39766df36ba91b3a1bd7bad61b07a656fcbd173fdb9eaf8bc
SSDEEP 98304:hpk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZv:hpQ2t+vqHD9t2tbCvZdC6TQMz9BP0QXL
TLSH
T152563359A33E89E714F33FBD66858F35608EBA53BEDB890CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 75f4a26f03ce4de007b170cb7b38a9f9e91dab154e2e3bd9017a67d9002f092d
- MD5 e78ad605b0d7aad54503f761bcdabfdb
- SHA1 f58bb482dbee74eb948bac5f2707d843f3f4d3f0
- SHA512 3381b9048b0333c3ad78e6bc308ddba2501d2143b091e02571bcf71d26b3ddbebc2c91f00e5ed7e73540752a9d0d438253c81e71b52c0ffb22d4410ae1d6848d
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHR3:3yOPsdq1N9vE1bPEiGut9HzgcPGY32Kp
- TLSH
  T16F563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2