fbd52645fc0dfa2fde3f8b0a9218a5c3853b70d4cd3d1bfcbe75768e3b67b8ac

General

Target
fbd52645fc0dfa2fde3f8b0a9218a5c3853b70d4cd3d1bfcbe75768e3b67b8ac
Size 5.2MB
Sample260804-d66j5scd86
SHA256 fbd52645fc0dfa2fde3f8b0a9218a5c3853b70d4cd3d1bfcbe75768e3b67b8ac
MD5 aa6207ca77c2a7375edfd038b3af428b
SHA1 745c46e466672d7d07652696b919b2e509271dc7
SHA512 332f771aedab3da62ecae3e5194a97a797654b68143b1854bb8956bb9909e79f88bd318dcf3b90b7494140f5169063f0f646f5e6ab7ec2d8250846d9d498ae2d
SSDEEP 98304:YO8cVkpOd45x/rMcM7QgzP5bch7Omse8LZEmPFHtrUg6XNuEDgbF2Os5:YDcVbd45CF7QgzPe/lgZlFN6NRDg8V5
TLSH
T1394633DB5B24BE14FF5D958623132AEFCEAFD394ACD5B00021AF32B4791D8C86581638
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j010.msi
- Size 5.4MB
- SHA256 8ed26dbeb6f8e76dd6718076d217c4fa4347542ed0d08b0b9380aefc415f3c32
- MD5 0aa9ea42f6e5b63ec1f769eeb1fcd67d
- SHA1 d5af2d3e64d876a5cc2abf04aa918d194eaf8936
- SHA512 a9ce046d1d5b3d2a41753c457f50c36de39176b7549077fa49a83ac05be9c520f0b698e4a73c93e92441c5b41a7ee85fea7ce09ca177bc429d5af45e81759e29
- SSDEEP 98304:PK06r4V6fscocNT2vxvxqgw182B95xEh7am+eAtYP/fH/PscibhuOjg9H2GIK:P4r4V6fhT2vu9182B9wTbAtsff4htjgV
- TLSH
  T1384633C979C93B35D45BC7B142027AAEF66D7FC49EA28C0237ED321C6E329599432718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2