4682d022a6f05690cad256e42b729ce14f00228d18d440a43dc300a33b449d7e

General

Target
4682d022a6f05690cad256e42b729ce14f00228d18d440a43dc300a33b449d7e
Size 6.5MB
Sample260804-j1er5azwfv
SHA256 4682d022a6f05690cad256e42b729ce14f00228d18d440a43dc300a33b449d7e
MD5 70ef6ad74ce57e58d9685ec843b66422
SHA1 0d946fe4fc57c197565951bac6aa38a1362d42ad
SHA512 58e9ff371780080853060489104d7a76b4b2c5cbf3ead258bfbcf445ea24eccc0200560c7e162e2403cd2ab457b39f35cb246b007fbd8076e56f057ed850679c
SSDEEP 196608:haEmTXicX4mg0HakpMUnE5hLrSWOrX6vzB7c6mY+UHiNsjoJ9iu6:IEqxvXM42SWRzW6l+UzoJ9iu6
TLSH
T13F6633D24F1AE4C0FF944BE1785ABCB566B118BAB04530E4BBD4905B3E0DB0B67D4AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c018.msi
- Size 6.7MB
- SHA256 da2e73637bbecb57ede81cde745d8dd9296a23dbc108ff951744d622b8780542
- MD5 3f951b59220da17bdd749a71c6715472
- SHA1 14bc84e459a1d4a101723c6c73aec24022eeb45a
- SHA512 b4e58acabda0ee9cb8d6afd8dc6f2e6d1d4f1ee79799ec9756ef258ad86cfdd4500051bdd6bf35ca9727af7ecfdc7be8149403bb1ce33402c2bd10c893af80aa
- SSDEEP 196608:aKt9y0xEMSc9+IL8nPZyaWV74hdTQcwSMiFkJw9IJF+g:a8LvD8ByaJhScFMilIJF+g
- TLSH
  T1906633C1BE8A6770E18BCBB0510265BE32763FD2BD118C567BE5320C7E3A62619F5790
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2