29fb387b763c964c96992822d9542705579964dd984cbdbc188e6732010c79c2

General

Target
29fb387b763c964c96992822d9542705579964dd984cbdbc188e6732010c79c2
Size 9.5MB
Sample260804-gm3wpasdma
SHA256 29fb387b763c964c96992822d9542705579964dd984cbdbc188e6732010c79c2
MD5 c15519f31b3045d17de67867e122b2b7
SHA1 ee8b7ba5dd1e040611c4f78c5108a3d931e0d929
SHA512 03c10e3a74069b3fab99f5c42dc13904ab8cca1ebf52f0058131acb59a4f1412e6459d5fb1f0d2016770f64e367c110d26d940ff396ce1882b1ddc7ea68fe838
SSDEEP 196608:Ig4+1LGEMeeXV4HNT+fgS6l7F/gdtZvcDcolYrJkB:j4ZERMetaoPmdfsPWrWB
TLSH
T10EA633AC063AF2ECA45BD588C561ECD21F5CB5974C6DE368F7F4429A0E542AB0123FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c013.msi
- Size 9.6MB
- SHA256 52793c228aafdae94c86e5f71c96ff4fdaca1c95f66e44fddd9d7806f4a51dea
- MD5 84aca7001bf015a483e745bfbb4b868f
- SHA1 71c0eac260e8d794d0b9ce220b1452f637acf13f
- SHA512 8e7fe717a5d47689cd26782319c38ece5e75b4fd7d07634610a31998cd09d9b22fba37fb726fb8375ca021ac6a8a2d3c158115774da94a84f48bce948db0dec0
- SSDEEP 196608:K7SnDN9VA2YmcXizV05J+NkNMQ6b7Dds/RcvEDUQPyb5Al:7Da2ZiizsJzGbC/SEV6bCl
- TLSH
  T1BFA633D8689A63B8D09BC3B0C153B8AE712D7FC67E6F990677E837401D3172600B6B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2