d64c743d74cf9bd289cf87b97e1a5cd5b8a3f5681539d0d90c20c7d36b732b8f

General

Target
d64c743d74cf9bd289cf87b97e1a5cd5b8a3f5681539d0d90c20c7d36b732b8f
Size 5.7MB
Sample260731-fbwgsscg65
SHA256 d64c743d74cf9bd289cf87b97e1a5cd5b8a3f5681539d0d90c20c7d36b732b8f
MD5 e007bdf2e9f23c3f049eab2a99e5d9f4
SHA1 53cc7cce2ccdb545f6534ee0399936ee53f2bf5e
SHA512 3fc6d6a58a50a3cff829f9a9dd929a73390c0cb2cab3a8e2a1ff623110928122535672c8b33b120c7e5e704760a62b6330f6df2a3a80fda39906061a52c5ee94
SSDEEP 98304:3VHUe4cSndsEFthfwo9lp63Nk/hVSQ6paPxjU9kW7/HLCRj/Oy/3Pos0QCA:pUe4cSndsEFwouNk/hqaPx49kWLny//1
TLSH
T1E756333B1FDC1E60295A4F57C2081937AF2183BD89A3F6E3D235B1B05BE8859C678B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal007.msi
- Size 5.9MB
- SHA256 ad161e786e54a3c486e6473af32983f921c08fa23bc91ace15ed8b9c63d75727
- MD5 469b93014483f9f1752c60530275d1cf
- SHA1 6bfeae76e75e91183df71a9993d9c40d64b52aaa
- SHA512 87bdefb778fa16070c7d811b5921db4ca23291f3d192c6cf0ee5be6bde457d3f9afd16ca01a69dd55c172afb2936e69254b32a03c2c3b8a23c33cabc5481c7b3
- SSDEEP 98304:JwGnxljxFjhf26l9p63fq/FPmsSLiYotErO6/zLSRfhIyrFZqs2ukeb:hxdxT26Efq/FYYErOapyr7qtux
- TLSH
  T1FB5633A67DC93BB1D49BC7749002756EB6393FD6BE12AC137AEC37401E32A299478341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2