3c7c8958e8fdd4580b56b58bd8a87ca34232ab2f67d49d90380b20666ab6a63f

General

Target
3c7c8958e8fdd4580b56b58bd8a87ca34232ab2f67d49d90380b20666ab6a63f
Size 5.7MB
Sample260803-1eyrjscl7x
SHA256 3c7c8958e8fdd4580b56b58bd8a87ca34232ab2f67d49d90380b20666ab6a63f
MD5 5ce955d652888113880441538b453d69
SHA1 02f665188805462f270e362d79dbc3543112d183
SHA512 c3c6b93b8fffabf34665d2f3ee4676be0f7c40c34a70f50d18de25499946fec7acd49f6db226be5bf9b707e8cce51915c4652c5cd08204aa94bb8ad0842e8b9f
SSDEEP 98304:SQkl5BgFDQasXmiD3kF/wRs4Mr5BO1XyQtt9yG/eYBnOm6S2svUq8ZaQJDyzDv:SQ4I2IF/DQwQJJVlIS2scq83uzDv
TLSH
T1455633CE0688E5C14F61B6765A34AE4C720ECA94D3E93BA9423A34D42E0FF541D9F5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j007.msi
- Size 5.8MB
- SHA256 325bdb88095b07af4d2cca7aa033a0372e200b06f826a2225c3fed007db677c7
- MD5 8a5ec3eba15eda8895f4be5cf3b155a8
- SHA1 3d1b739505424bf1e6f2a4d8b0659abf79bbba83
- SHA512 9aeff36069f7c174ea604546ad9fd60fea26bafb766eeffcdf312e811d211448b03cba992e0279a8de0adcd25564f66e5116f7e9a8ab2fb58b0aa1259c07ba25
- SSDEEP 98304:6J9KtA6QN/1ps9nU7s4y/vT41r6J/uGlpOeKIsRUo2zyyXxy319:49VN/A9nNMd6lZjiIsao2fw319
- TLSH
  T1AA563382B9CA73B0D45BD3709522B55C722DBFC0EEB51C1B76A9360C1E37B0518BA35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2