9043e9939c5ffa0cc47dd65a9eb2d2562a55719d560adaf7174c13ff51007f0f

General

Target
9043e9939c5ffa0cc47dd65a9eb2d2562a55719d560adaf7174c13ff51007f0f
Size 7.3MB
Sample260731-ec89lscc22
SHA256 9043e9939c5ffa0cc47dd65a9eb2d2562a55719d560adaf7174c13ff51007f0f
MD5 398a4209f2e13fc9d6fd0be72c01432d
SHA1 51e86845d9c441cedf7f937a6c29f8e5b1c509e7
SHA512 1878b71a64deec9d815d748e9a017eab7d35dcfa5dd18b332571171f1e01c526ee0dc2980fa2ce675d7a71589ae6c0d83e485176f14050a789df61c6029c962e
SSDEEP 98304:5S+LaQziiR5X3DajL8cr2kj8XVof7Tsv8p4ZH7OK8WkbgadjIKbRStKGpNue:/HR5HD2aXg7Ts0GVO1WvaOZK8ke
TLSH
T1857633D5F44929C939236A647ABBB3689142CFF508784DC5537FC0DE60F8862B7A90F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal005.msi
- Size 7.5MB
- SHA256 c7b1bc6a181638c8c9e78117aac037d6161f9c32306bdecc0b0088122520a7d1
- MD5 f4d746978d9b3b252d7a29121fab5ebe
- SHA1 f6d672758bd02cb87debb0c8375465fad78f0f2b
- SHA512 722562bc27c673c2b338deaac6122d6e40ccd91ff734c7a823dbea2e12f9f5ac43fa1c61860bf08b9556a741896b9a987a29838e10fbbf3e4bbaba3a70e6364a
- SSDEEP 196608:8JDpXvRhLBR/nDU6WVC2zFbP8B0FgYLiKp:cDp/RNBJnh/2zdP00iYuKp
- TLSH
  T1BE8633C5BCCA3BB5D053CBB4A59272AEBC187FE4BA728C4673D972085C727262375244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2