a8e5d7ff18fe65bdff40fa1b6aaa68a2396a520c6c5b57d1ab0b87af1030e74e

General

Target
a8e5d7ff18fe65bdff40fa1b6aaa68a2396a520c6c5b57d1ab0b87af1030e74e
Size 9.0MB
Sample260801-wlwtbaee99
SHA256 a8e5d7ff18fe65bdff40fa1b6aaa68a2396a520c6c5b57d1ab0b87af1030e74e
MD5 5645b645673ac6b5b28d71bf96e304f2
SHA1 9ca12323df24cb216fbc83cc975a3836ac57fd8f
SHA512 a3ae485c5adc9ecd4fc638ba82a550e1fb5b4a3ac0dbb77fc9af625382daecabb38629bad809128a64f5753f986df73e489a74d65b8a0d708e9f8a1d0612c3da
SSDEEP 196608:XFTi7+2cs73otZiLDKnRxo5JirozsMHhkizS4C/x85IM:Vu62f783obi+fHWizS7x85H
TLSH
T12C963385046E95A1DD8FB99CE32A7D3D93901F74FF92C1DA42CD88273F029006E6DAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_pr0j007.msi
- Size 9.2MB
- SHA256 d94085e13deaa6ae4944149bc58ebec1f080268126e91c32577f51f9c029f00d
- MD5 a27c7a26f39c1b6c8e24adf6266f2d09
- SHA1 312b5fe1a386cf01b130c9466367c639c3d02229
- SHA512 349565d76e0fc7ad52551884c24434cfadbfb58cec9a87a0a4e1b72af5cecf870ff89569562a456845d5fae0484b5258369ae883eb2717cf14b27524188260a5
- SSDEEP 196608:hNooDCOTdiFhQAlXukPnW5h8FsLsypz26vAB7QZF2nI:XNpTnkWr8y1pK6vABCF2nI
- TLSH
  T182A633C5B88A73B1C58BE3B492137F6D7D253FC5BB268C5A26DC7A003F326112679681
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2