238d6397e01e6dce0494e2934ee168ee4f931efbd123cb532cef1f1f5c30d085

General

Target
238d6397e01e6dce0494e2934ee168ee4f931efbd123cb532cef1f1f5c30d085
Size 9.1MB
Sample260804-hn8c8sytft
SHA256 238d6397e01e6dce0494e2934ee168ee4f931efbd123cb532cef1f1f5c30d085
MD5 244009a631af0ed82c7cd6d08033612f
SHA1 60ad899f83607ed0031c9b010298ddecf378a00e
SHA512 9370e4334a653397b50992927c9961d364958a26064f512841593c67491e1490e93b19fbbe641cd03fec7090bbd722dfb0f58314d0ca49ff65d9eb0f54ad02e0
SSDEEP 196608:D+2zxXisJiGdNFTHSq9ZoSXmfHlCkUy++lDxBkT+nCYEN:C2zxXjiGdjnhm9kfiDxKTGoN
TLSH
T1DFA633B394BDCEA5B494A772C04DEA9174FF8EB162390B02B22751171D7860770B8FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c017.msi
- Size 9.2MB
- SHA256 c0c79b2ed2047950eea3608aae6d541f71310f32900a69ef631e5db54ffe3a93
- MD5 24f4efa285635123a5136a0db31230d3
- SHA1 92a6fbe347336a75cd96eb967bf37ee1d19b0cca
- SHA512 2acee37534824e5b4432e18be13d294099e4da90f5e472146a06e68908490fed8348a64dae38e86b734300bbab12a4d75155092a67401d21ec6e298056275486
- SSDEEP 196608:P2s8+khACxWodtr7FuQtqOz8sJAZu2S8KuN11B+TCj+WDuc:Dkh7WodT9tltawpE11QTMt6c
- TLSH
  T1F3A633D3A88E6775E087C3718147B49C70BE7FD2BA260D0273E97A052D7162660FAB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2