3394953499d961e1aac84c082042487310071e7befcec781ef9aabb238e8f811

General

Target
3394953499d961e1aac84c082042487310071e7befcec781ef9aabb238e8f811
Size 8.7MB
Sample260731-eb7dmavzdz
SHA256 3394953499d961e1aac84c082042487310071e7befcec781ef9aabb238e8f811
MD5 d31dcf8594c0143f55dc0d97b51edb57
SHA1 84c9875c899677c98d445a37af5c22c7bb8b9751
SHA512 c1dfdba8de079c4330440e5d459fb70661be8b2c793893e3c9519563525b06e9d6c94b0c11e30f35e2e4c42d081c90dce60c9aa2a037d0142ea5800f66519877
SSDEEP 196608:OfZnKBakl9olemMMdabGIark6onNYyeQaedwtlZreKTZP5TjacCYNMCKozal:SZnIll9gemCbGexNY+T6/sKTZPfNNq
TLSH
T1C19633283716F7899E099B1454AD86135514C38FC3E861AAE8FE357EB212BF091DF21F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal017.msi
- Size 8.8MB
- SHA256 f93c7fd85253a0e4d3fa43778abbcf3f6b1de4636f772ac58e630c2ef47c1747
- MD5 a97dab0d10845d7fee2290b994471e2c
- SHA1 b97f41805246fe7721d4aa2c5f76a12dca062fa2
- SHA512 bbd867c447df48cd0d578a95049c410fff9f6016e70d6b88a6fe9faceb2db26f6d215dce027642ead28069698d0d97d2dfcebb6517e1108caf4d4eed26a51921
- SSDEEP 196608:Gfr5aBckL3Q52UiI/abgiWeS2+ZbpmguUeTsJlhtwUPdj5J1agAYXcyYoA8D:Kr5Y3L3e2UcbgixSZZ9wJArsUPdjx1XH
- TLSH
  T1609633943D867371E953CB308486B82D7D257FCAB3664C1B7D9D3A105A32770A2FA34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2