85c17bb0157afcbc1cb3425f77c464037bfed529cfcf27c762b593421e4966d0

General

Target
85c17bb0157afcbc1cb3425f77c464037bfed529cfcf27c762b593421e4966d0
Size 5.2MB
Sample260804-d68phacd92
SHA256 85c17bb0157afcbc1cb3425f77c464037bfed529cfcf27c762b593421e4966d0
MD5 684a80deb0a695cb5cba7d8799d8a575
SHA1 62c3364860907a642a68e6952ba77b611efafaf1
SHA512 ff3292f037535b2bac27bd3cf5e3a2db75e06478f3721b776eb26dc1e454b6b3f588e4a21b00345cc9570c1ed68f65cb4a8557b056239aa2fbfea22aaebfbc67
SSDEEP 98304:tO8cVkpOd45x/rMcM7QgzP5bch7Omse8LZEmPFHtrUg6XNuEDgbF2Os+:tDcVbd45CF7QgzPe/lgZlFN6NRDg8V+
TLSH
T1C04633DB5B25BE15FF4D958623132AEFCEAFD394ACD5700021AF32B4791D8C8A581638
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j010.msi
- Size 5.4MB
- SHA256 7ef577094a6d84f41fcf74075c0941fe6f15f8f77e7f4e1ee2d4e1ffc5b59b08
- MD5 c9a714568141c8585efcea6dcdcdeb92
- SHA1 73d9f976c6ad396a9456f154b82f7d3cfbbf9397
- SHA512 143cf27be5c0bbc6906bfa0dd4446fb1e02cfd96c62e9dc895a778b9f2c7b885d53974405e7cb1d3321cd399f9514980efafc5ee0b703a6dc9e909e57dc3f872
- SSDEEP 98304:PK06r4V6fscocNT2vxvxqgw182B95xEh7am+eAtYP/fH/PscibhuOjg9H2GIU:P4r4V6fhT2vu9182B9wTbAtsff4htjgL
- TLSH
  T1FC4633C979C93B35D45BC7B142027AAEF66D7FC49EA28C0237ED321C6E329599432718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2