57f974f8ddb266d8ee40958bd9f700d9f18881f738799c2b38e88eae49a3e962

General

Target
57f974f8ddb266d8ee40958bd9f700d9f18881f738799c2b38e88eae49a3e962
Size 5.7MB
Sample260731-e9fzbscg42
SHA256 57f974f8ddb266d8ee40958bd9f700d9f18881f738799c2b38e88eae49a3e962
MD5 af31003ee7c5bf3ce4b508c796ee70ad
SHA1 9aa28721f2658da78a98eaf68b93f8d3c0f00d88
SHA512 86fb067f9540be1e7defa4978e2ec2f4edab812ac5bdd3be7d592698d528dafc05eedc0227d568b3b8c20c8608826557377526ae5a2bc64b6cb4a0806f1237af
SSDEEP 98304:dVHUe4cSndsEFthfwo9lp63Nk/hVSQ6paPxjU9kW7/HLCRj/Oy/3Pos0QC2:fUe4cSndsEFwouNk/hqaPx49kWLny//H
TLSH
T18F56333B1FDC1E60295A4F57C2081937AF2183BD89A3F6E3D235B1B05BE8859C678B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal007.msi
- Size 5.9MB
- SHA256 af67f4e1374475773c764bf068cbe4ac526ee7aa30da35b94adaaf9c42bde29c
- MD5 fdea78a5744814c2b2f4f03300d31afb
- SHA1 79a3e61fcceba9d0a54f0b4c70791a4f7c280bf5
- SHA512 55190c1365326a8616e44c6cfffd7aa5bf86c8acaa9fdb00fd53c375e05d2ff1e69093009ef9e5b78ffc95b435ea2e4d4b669fd3ba47b2201869abb48654faac
- SSDEEP 98304:JwGnxljxFjhf26l9p63fq/FPmsSLiYotErO6/zLSRfhIyrFZqs2ukeB:hxdxT26Efq/FYYErOapyr7qtur
- TLSH
  T1565633A67DC93BB1D49BC7749002756EB6393FD6BE12AC137AEC37401E32A299478341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2