98556ede9ac523ebd3115e4a4234267413b120bc03b72da74d27987a66e9a7a3

General

Target
98556ede9ac523ebd3115e4a4234267413b120bc03b72da74d27987a66e9a7a3
Size 7.5MB
Sample260731-egkrtacc52
SHA256 98556ede9ac523ebd3115e4a4234267413b120bc03b72da74d27987a66e9a7a3
MD5 513ef1661807c93ff82ef6338a78e4ec
SHA1 c388efbb3157b5e2b770d2b159f138ac950bbe66
SHA512 d258b675a69a2e141672b714858cb9bc5299f480120bf59cfd2f894fbc1af744ae99de36e57a277a8107412c8ece9a70a366b7690bfdc8a684400544b9486bfc
SSDEEP 196608:Xa3yNZsWmE5G48H/fCQ9RhQLjZQj+DE4IALirOHbew:quqWH5G4cf1KjOwIs3bL
TLSH
T14A8633E844EDD198F3B176C64B83228D3E39E2A3538DEF6AFD5225017C953376B0548A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal004.msi
- Size 7.7MB
- SHA256 8e1466594c30ec53f5c3bf8769f5bb67628f06586cb63fb5232c4a7d3a70ff50
- MD5 7e313f7a82f8bf933cdea3390cf4c187
- SHA1 209b3592dda535a8a1f726d4d3287c749029a637
- SHA512 8129039e48c23f16425a6cf368ee9beeb2009a24ed0d01dc9ae37426d4d900726b47aecba67498a07f1dfe765698f685e8ddc0d85294cc375f6dd3637846ce92
- SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrEx:yPKfBIe9y66qJ4CYmzr+
- TLSH
  T1808633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2