dd3ee79b68a93a69408ebfdbd74f52d0d1cf7e3488c4fc0de6ade895c89723db

General

Target
dd3ee79b68a93a69408ebfdbd74f52d0d1cf7e3488c4fc0de6ade895c89723db
Size 5.1MB
Sample260804-gksypsscqf
SHA256 dd3ee79b68a93a69408ebfdbd74f52d0d1cf7e3488c4fc0de6ade895c89723db
MD5 b1dd9b9c261610ab5da495ad95f6edf0
SHA1 8debd8b3b7139e1cee98936d6e5c26f43d9252bd
SHA512 0ae268bb50d7418845026032ff984266212473324ed61141c440daaac118a85439fdc203e1d0811e23e387d3cf24caf0bf764ea56ab814b9ae0efb520517dfd3
SSDEEP 98304:DQwF0/Gb2Lqsm4ZMEnmf3sM9ZkP2U3osmX5hBYR5Wq2LjDSdxXST8:UwF0/G63m3Uq7UYsmX5Iqq2Lyd0T8
TLSH
T1774633C09471EF608B4495E6C26667EC8CA8FBDA7967DF5F814BD1263D044FAAC88C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c014.msi
- Size 5.3MB
- SHA256 c8224bd90efd81eb267358b1a57995dca80e0919afab8c97840af27c97e4f0f5
- MD5 9ab1814b24feb264ddb0fe789151f245
- SHA1 0f9a93fa217330e6e07a8ee6e9ecda89f1c17b16
- SHA512 157f0ddf80c85521afd4765a95f659785a646093e02295468c59fd4ce85be7f11bb35efa7314aa5184d82fd421e8bd3452564ee44cd268e4e5b13ee426029d63
- SSDEEP 98304:xRrwSKgwM9ZRYuX8/IE443gwH4f/w8TFRztryA47lBMwl3kYk1jZSLrXQxg:xRrvHwMCuM34Dg4Ztrp47lywqYk1QLsG
- TLSH
  T1DA4633C429C66B30C05BC7B18217B6AE716D7FC6BE329D0A79DEBD082E3111B5875B09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2