84192c4f860242e7b9d00f60c90b40d737707d0057b2d6823e4321a616ffc1e7

General

Target
84192c4f860242e7b9d00f60c90b40d737707d0057b2d6823e4321a616ffc1e7
Size 7.4MB
Sample260801-vshdtssarf
SHA256 84192c4f860242e7b9d00f60c90b40d737707d0057b2d6823e4321a616ffc1e7
MD5 df4cab63d849dd9d0b83ddf013b30c99
SHA1 733a25573a0efda9a86b2979ff43f8a697bd8755
SHA512 bae22274ab7a03e281b181969e9d371e36da3de4685d0f62364a0ac0e0f093a990e98eacdd2c356bfb4b572c76878eac413f73f5775ae4c2b80f7e122cb3e2f5
SSDEEP 196608:044fhCJxaLkiZSEM/9zHjYO0ropgHhvxxLDbllIrsRRkO:04gjoOj09zHjXyo+HhZBDbllKO
TLSH
T14076338F6094D04BEF9364B9B7ACFBC31ED2EC8BD1E335E3B146805196538D142D89A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_pr0j009.msi
- Size 7.6MB
- SHA256 a527257f6db4082f03984f1fb51d5b6957a3c02d6292f9c0dbd1942250bcc6ae
- MD5 869a72c4ffcc6ac028b48e0009985207
- SHA1 5d3cefc230e0ba0b0307a9da1d39b0fb58d3ace2
- SHA512 805d4eb0876a6d61eac30564591cb27a2568a013f427d8206cab38d542a0a0d022efcca8e64ec188dcbc147a06bc3246b87e65033b3f658edc2e53b8b22a0f57
- SSDEEP 196608:gGHpjjfaZTAL2KZS+E55TMdc3GQayfRVuB9Nflv3tv7IDqlRUC:gcfv627y5QyuyRUB9xN3tv76C
- TLSH
  T1C486338AB8C67271D49BC3F1A246B69E3A667FDAFDB30C1776E935402D3362501B6304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2