46c99eb460fd23a63f2c44d8748f8c71bc6622961121d86c2d7528d643016465

General

Target
46c99eb460fd23a63f2c44d8748f8c71bc6622961121d86c2d7528d643016465
Size 5.7MB
Sample260804-a4xmnsac79
SHA256 46c99eb460fd23a63f2c44d8748f8c71bc6622961121d86c2d7528d643016465
MD5 b11b70ce8f84c0af9cc842d1a344134a
SHA1 e2c0bb654cd47de13a48070035cabef2028fe06b
SHA512 bfc1b5d6ada347e5d68edce6dee7732fea2c93958549f3ea5659c546513c9b8125c6e8f5a371958bbb7967e782e6f50a04054b224ec4e47aca964aeb9f22c7ae
SSDEEP 98304:qQkl5BgFDQasXmiD3kF/wRs4Mr5BO1XyQtt9yG/eYBnOm6S2svUq8ZaQJDyzDw:qQ4I2IF/DQwQJJVlIS2scq83uzDw
TLSH
T1B15633CE0688E5C14F61B6765A34AE4C720ECA94D3E93BA9423A34D42E0FF501D9F5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j007.msi
- Size 5.8MB
- SHA256 7c3b351fbb585ed318c17ad227f1979c9cff83c741810841a24710550f8be5d1
- MD5 506695953239ff072f985955f86b72ab
- SHA1 96a8f1007a7a1848be49ac9735b2a0b57f588a91
- SHA512 0d4c2445152f8ab1a363b55c436b81f2b5cdfa7168a344cb1a9aa34bbe5e66af34ee81616d49d33e9dcd06a6cd2b238ce70c56c92f8a940ea6e355aed71a47fb
- SSDEEP 98304:6J9KtA6QN/1ps9nU7s4y/vT41r6J/uGlpOeKIsRUo2zyyXxy31p:49VN/A9nNMd6lZjiIsao2fw31p
- TLSH
  T172563382B9CA73B0D45BD3709522B55C722DBFC0EEB51C1B76A9360C1E37B0518BA35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2