3efd6b8ec7a0d4b3a6069d392042cd96366e623971757bfea562e2dd5612c672

General

Target
3efd6b8ec7a0d4b3a6069d392042cd96366e623971757bfea562e2dd5612c672
Size 6.1MB
Sample260804-d5cwfafm8z
SHA256 3efd6b8ec7a0d4b3a6069d392042cd96366e623971757bfea562e2dd5612c672
MD5 0896099276575f8ecd7710af8ba899e6
SHA1 4b47b3414b1bd23988337b83204a0435c2ec9779
SHA512 b55adbe92a392ee9308a854f010d4cb4fd4e7f9a9b7210ae06317a24af69b342be8b9a9d8f73b4db648014f9d856960110d565c361ef4b85709a7659edfb5c05
SSDEEP 98304:YTP5kyMXaRpgqfxV/86E2jBcZZudnolKhhVnoxv4sWM9J/HRTKsiAeCxDaYTt/2H:O5eQ2ax2iBYono6hVY4Ezsqbt/2H
TLSH
T1D65633F122578A14F8EBD1CCF5FA031C421628AB156535CEA03F93DE6B9F4E1D4826E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c011.msi
- Size 6.3MB
- SHA256 3a426a13d4a4f90b0fe8a7ea0f9f236932f7891159da0805e4071a61ca072b20
- MD5 224b2b4846345b6ac57d7d3217cf1dd5
- SHA1 20f36d657c9556930925b55b5c0e17e060e8b30d
- SHA512 3537502c3165f84fbe62f69eb0aee7d358c16efe4771ca6dd82d2354afc37b6f0e3f5a7d5873c3b4171d4b4a0532a7177f8c60a5d90a8741b6a680cf75c94ee4
- SSDEEP 98304:G5uZ0ZQIG3+RbmMpNo14nFa4AUsBCvVvouVfCKfJ3f5XkqiKCC77AYZHx0v:+ZIMCCNbFa4AUsBCZoIfH5QSTHx0v
- TLSH
  T15A6633D438865730D09BC7B4A0E2296D7D393FC676B28C4EBB5E32242F772265276385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2