0cc90910d50172662ecd5ef09827ccaaf3895ca8a27f9506f3159d4ac4a1444e

General

Target
0cc90910d50172662ecd5ef09827ccaaf3895ca8a27f9506f3159d4ac4a1444e
Size 5.7MB
Sample260731-e9f94aaq2s
SHA256 0cc90910d50172662ecd5ef09827ccaaf3895ca8a27f9506f3159d4ac4a1444e
MD5 d222fddc4a6e60404e52e1676f58bd08
SHA1 190dbff1820640ee507f1dedaf1beeb78531df78
SHA512 9b325e31f6b636dee791fafe1529f85c420dd1ae6256ea128e55659d38609233b856e05f30fb8b04959b888932975ac30bdc7447257f312f3af577855ca77434
SSDEEP 98304:6VHUe4cSndsEFthfwo9lp63Nk/hVSQ6paPxjU9kW7/HLCRj/Oy/3Pos0QCW:QUe4cSndsEFwouNk/hqaPx49kWLny//5
TLSH
T1C056333B1FDC1E60295A4F57C2081937AF2183BD89A3F6E3D235B1B05BE8859C678B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal007.msi
- Size 5.9MB
- SHA256 d46061596da74f4e18ef47ab9fc2eb365cd4778732f38a2464510fbc0f3c3443
- MD5 e638807bb87989cf2881aadc85ce10e8
- SHA1 43095aa1e1b92986a23037aa02592697f3c80675
- SHA512 71509c1606b1f65cb265b3e383482b513d01bfd446266c59d344fd36c12c8d16bfb9eac692283b64c4fe946ac3795b75a4023ff72103c20c651282b846c90c9b
- SSDEEP 98304:JwGnxljxFjhf26l9p63fq/FPmsSLiYotErO6/zLSRfhIyrFZqs2ukea:hxdxT26Efq/FYYErOapyr7qtu8
- TLSH
  T1EC5633A67DC93BB1D49BC7749002756EB6393FD6BE12AC137AEC37401E32A299478341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2