348606fe975138f0c0525b71679841529c463f16ec309573fbcc1771765331e8

General

Target
348606fe975138f0c0525b71679841529c463f16ec309573fbcc1771765331e8
Size 4.9MB
Sample260731-fg27jach68
SHA256 348606fe975138f0c0525b71679841529c463f16ec309573fbcc1771765331e8
MD5 30b0252cd27b0b5d062fb50c7cedc202
SHA1 d1db0fe198a18743d0cb8ab955f555b405660df6
SHA512 c6b3440252d0468de91e679fa86488934a26615f2ca81929484f47dc3bd52d6e9a904e83072c90fb9ffa302b04a25e49971b3a2dfbdf3df3e1559b496b427963
SSDEEP 98304:VFsOUW3UzQFdH1yMQyJTZEHJQkXP4QeMb6iHa5yY0WnNzIj8188rZzxT:VFs5rzeBkMpFEpnb6tyY0WNzIj8188tR
TLSH
T1BB36338698662CD2CE27596D7C62FA1F3C0FDD4998B014B9623175D37896BF1E02B2C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal006.msi
- Size 5.1MB
- SHA256 24e03768c3bf770e17a9aceddb4d149527094b430743ea32f4336b30c7836de7
- MD5 25b22bd2915d656275e42842d009d03a
- SHA1 e9eab23c31551a5b2e9d9a103d9ef6310fe89b3b
- SHA512 54a8d429d6b4fcfd39385f99b8cfd19aea7af4406a262ecc268f65695350a8fa03b6ae73aa01f99561811fab4d3bc0e648de8b7c5caf78a80cd8a6dd7979d54e
- SSDEEP 98304:rgfcAQ/XHzG68of3LsfbKk7l49FRy5lgX9/nMM6VREBwlU2rZdtT:rg9Qf66f7sTIFRy5lgPMMgREBwlU2td9
- TLSH
  T1AF3623C9BCC93671D147C7B56152B23E392D7FC2BE624C1B36687B441EB2636A036386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware discovery exploit trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2