973f383e0c41ed55b8c96d47332d268ad9774959e89359a6830212c1eace678f

General

Target
973f383e0c41ed55b8c96d47332d268ad9774959e89359a6830212c1eace678f
Size 5.8MB
Sample260803-t283gacc45
SHA256 973f383e0c41ed55b8c96d47332d268ad9774959e89359a6830212c1eace678f
MD5 980df0ee0dd8122c43105ea2aa9a67a5
SHA1 f01a6c18f6bd87ef665e632016099f4b88952c56
SHA512 71b63e13c8a4ff621082588b56f85b89fd47f9153e1c6cdaf86f5e586d5b8950f80820ceab66f91c75dbc1817f6d79303db4c230ea63db5d5f6cf3b95f1dd678
SSDEEP 98304:9VwDJyPuGvVMUku4/Uxa4k4pwxt/rTe+/xyywRLpgwCW4eRNpNfUd:9Vwc3dMUku4/6tk4At/rp/xy1Nr/pNfQ
TLSH
T1E95633E68845A8DA5823C5E1F05CA7053A1E81D69CAC7EC3BEDCB3845893BDF0579237
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j017.msi
- Size 6.0MB
- SHA256 57c431098fdade80c444b992ec12b9dd5621462b9c73c3fd2c4c0819e89544b8
- MD5 0bdc044cb7dc7291cd1770e88b7e6e2d
- SHA1 4211d70aad5514bfe4891275b954930d49a16952
- SHA512 ca701c32448e8033d200da543cd56781095f760873ddc208de7f42d974df12c00da336604c2b1219be47f9ff7dda4f7327662eb8a2850de4980d8585848c9091
- SSDEEP 98304:h4vn+vuSDjkEe24nOjJOHxHh0kClfLv+TFlsVHkVu/vdwxLViwCaW4j/p/fAI:yglHkEe24nmJOZh1Cp+lM/v6pvjp/fAI
- TLSH
  T1625633E6BCC563B1C097C7B09096355E7D2E7F81B9AA5C0B76CD76402E733164A3A30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2