1289806d6e0fe164b20a27e52b461d02375acc83987951a205b855e3534c8cc9

General

Target
1289806d6e0fe164b20a27e52b461d02375acc83987951a205b855e3534c8cc9
Size 5.2MB
Sample260804-d67gfacd88
SHA256 1289806d6e0fe164b20a27e52b461d02375acc83987951a205b855e3534c8cc9
MD5 4a96ed49010cfeec6f76086079734592
SHA1 ee4eebd447b2c7273eb34987a3e0205d40196cc5
SHA512 ce5a32e4101118c617546576300e86e970f6f1f80a8eb32329b9795bf6ee470dc1ebf95a378a6d7f2fb1cffc055fec509fd24f076053a9867ff5185c7c44162f
SSDEEP 98304:CO8cVkpOd45x/rMcM7QgzP5bch7Omse8LZEmPFHtrUg6XNuEDgbF2OsL:CDcVbd45CF7QgzPe/lgZlFN6NRDg8VL
TLSH
T1C44633DB5B25BE14FF5D958623132AEFCEAFD394ACD5B00021AF32B4791D8C86581638
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j010.msi
- Size 5.4MB
- SHA256 f137e75a9459dd1f8e76d5d43bc7e45b05a1447d68997ab9e232831335acd470
- MD5 b90f4b97461180b68f91a329f05fd7c9
- SHA1 c2bd1d9145cecc4cad90f8c653ba810eede81470
- SHA512 4b8799f27548daed0ba3ae550ee0bd31a1fba0491f48b9cbfcb2c1157159d795b9de9fd320d35552d9a57d892401d1f9d7484be2c5ae0cdc6cc8ddf8003783d9
- SSDEEP 98304:PK06r4V6fscocNT2vxvxqgw182B95xEh7am+eAtYP/fH/PscibhuOjg9H2GII:P4r4V6fhT2vu9182B9wTbAtsff4htjgX
- TLSH
  T1DE4633C979C93B35D45BC7B142027AAEF66D7FC49EA28C0237ED321C6E329599432718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2