a392075280750e7b48bde1eee29596ca2119b9d6ddd113770ca24fcc732b92a6

General

Target
a392075280750e7b48bde1eee29596ca2119b9d6ddd113770ca24fcc732b92a6
Size 9.8MB
Sample260804-1cfsys1bpa
SHA256 a392075280750e7b48bde1eee29596ca2119b9d6ddd113770ca24fcc732b92a6
MD5 77e0cb232384dc065fbca0674996d47f
SHA1 9f85d051f528f7e215c5f4b0d4bf5f5b22ce3f12
SHA512 098ea63425dda237f4941b39236755c65940c987d016dc9e482786599a64fb1940c1898cd08f8a8e2040795123d07e40e477848d2136a9fa2185b3a9b023a11e
SSDEEP 196608:uq4NyL/tAMrbF7ETu4V08NfmWM3jf/1ok+tPq/VGh4la278JHrC/dm:bEyjWsgFV08NeWMr1ok+Nq/Hla2+mm
TLSH
T150A633424A53BC34F4473C9729D6D283E56A598C9EC7157D87E32D89CB9CEC0A306EAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  inst_s0t010.msi
- Size 9.9MB
- SHA256 0cef4cf710f0add2216ff3b239e3424ce551a4921967e126472b23e5d596ab2c
- MD5 eae54cb6103ba95802b35b174ba1cbb0
- SHA1 68eaa34d8045fce7e0aec99f3b9fdc401d504d50
- SHA512 a50ff9245a1ca895c41184fcddac75c8c3743c48657d7ec85baeb9b444d759dd11a6486e239731f7e628065f92a31da49a68b49bb30c555168e22871d8913d70
- SSDEEP 196608:7AMVgtRDK0JjBtaFB28NTAeoXRL1NU+4xl0Zn+92hmcveT1Du9n0:7hVgL+Mte28Nceo7NU+4z0ZVhmcuG0
- TLSH
  T15EA633C1B8937F74D08BD7B25182B0AEBD297FC5BE978C2A27D536002E71A615336748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2