a5e5f9d51275fce537f7c5070f099bcb5ff93be30c7882884071a0cf2f764af8

General

Target
a5e5f9d51275fce537f7c5070f099bcb5ff93be30c7882884071a0cf2f764af8
Size 7.3MB
Sample260731-ee82matcqh
SHA256 a5e5f9d51275fce537f7c5070f099bcb5ff93be30c7882884071a0cf2f764af8
MD5 2fa586500967f7d0579df5d75e7c6381
SHA1 c6f754546e482b35fb91dc2e464ced4628418e0b
SHA512 0a553412aec73cbbca1e788c96db8a26fd2e5d6a8f09cdf48dfa0bd2636f4e1fc54315128768fbe2555f10eff8d1b94a816c6ee42b8af2492236efb37d118905
SSDEEP 98304:4S+LaQziiR5X3DajL8cr2kj8XVof7Tsv8p4ZH7OK8WkbgadjIKbRStKGpNP:qHR5HD2aXg7Ts0GVO1WvaOZK8V
TLSH
T1F97633D9E449298939237A647ABBB3589182CFF108784DC5527FC1DF60F886277E90F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal005.msi
- Size 7.5MB
- SHA256 c968eff6ddb17c675584fdbba7b414ca83b65db343d36875a409cc0abcab7fdf
- MD5 908cd2bb8d632ab268da614d408e56ce
- SHA1 1d958c4fb0589d506b0092f93997f499e53bc13f
- SHA512 0d8f93940c9af42103f8e374275e913e7d21866138c0e9c6618e95dd1ffbdfd741f46f883009487ddb625092ea494559dd8fb1b543859bec335fd8a4e55e7d2a
- SSDEEP 196608:8JDpXvRhLBR/nDU6WVC2zFbP8B0FgYLiKa:cDp/RNBJnh/2zdP00iYuKa
- TLSH
  T1FD8633C5BCCA3BB5D053CBB4A59272AEBC187FE4BA728C4673D972085C727262375244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2