c156563d1043e85e870be0e95fb4ffb800c2cb940be2743a8f2ce78ce6206453

General

Target
c156563d1043e85e870be0e95fb4ffb800c2cb940be2743a8f2ce78ce6206453
Size 7.2MB
Sample260804-d9f4navwcz
SHA256 c156563d1043e85e870be0e95fb4ffb800c2cb940be2743a8f2ce78ce6206453
MD5 0d7475467d66ff26ae26b1abe1225736
SHA1 e594b36441da1205c86f35dcb80ca5af590a799c
SHA512 2cb5f3805849589f255753415c9779c87720e6429a7e2aae460315a841bbfcfa4540ffcadcf4f2b8d62795cee1df653ed2661da7d182fb7796d12a154c2f011c
SSDEEP 196608:Gb60IsgvOdZ2AQ9G4J0zmaQSwPhxTlrUhj/StPMP0:c67sgmZ29lJ0zmaQSwPFox/C0P0
TLSH
T1CA76332FB67445C415AD280EAA8E75CF4EBADDC70A3DD61143E44EA03639626F420DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j009.msi
- Size 7.3MB
- SHA256 5bfa0c5e9f7d311bd3cba1e6962eefb85ffad1fe5a0055dd3c41a8507c79130d
- MD5 af159a0e1a39f98eda560157bf7fb234
- SHA1 4f5cfc3a4348f54731f8764e1131001414dde3be
- SHA512 f4839ed3f2a6753f64d23c5ecac1e346df5f368edad59dfbaeb4ac5d2c605da0d4409044eeff56d9d13deb00ce679ed232102499ea09b376bf150cc7bcfe69f1
- SSDEEP 196608:QXt55xUprACGzmK3wQSmAglLRZdJ4hzj6nxCx0:oGrAhl3wQSmAgldeljyQx0
- TLSH
  T1F176338ABE8167B5C09BC3785246358F7579BFC66E3E8C0632E87E482E327176071749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2