3590eff3d068a85818b9b80c50be49414bfa0209190b76e54c3bec60ad9d74bc

General

Target
3590eff3d068a85818b9b80c50be49414bfa0209190b76e54c3bec60ad9d74bc
Size 6.5MB
Sample260804-j39qaafh66
SHA256 3590eff3d068a85818b9b80c50be49414bfa0209190b76e54c3bec60ad9d74bc
MD5 7cc3dfdb11dbfcaf2a84f1518e76b27b
SHA1 40a74da4c8ea95acff41f6900c8c193e63a4d4a3
SHA512 37e0bb211b02ca161f6809bce5f831ab53dc0944b373de19b44453b769ca5278220153821f988ad8c5e56b8e1408c88e6bfc4953ae7fe6d1383fbf73ff38f841
SSDEEP 196608:laEmTXicX4mg0HakpMUnE5hLrSWOrX6vzB7c6mY+UHiNsjoJ9iuT:8EqxvXM42SWRzW6l+UzoJ9iuT
TLSH
T1746633D24F1AE4C0FF944BE1785ABCB566B118BAB04430E4BBD4905B3E0DB0B67D4AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c018.msi
- Size 6.7MB
- SHA256 11fd09abc30abc6d5713fc83171918c7713bc02347dc1711e9f5480c80290f1b
- MD5 a1bd04fa4ddfcfd3dec546260184e683
- SHA1 3148542d209ed6df0163165854cfe8f1e64db40f
- SHA512 3f6b5d1400d3bf345c0d704f7bea8d014bad8bf588eee0c7aed2195d62fbb9c73d4b59a2a4914b20b9e19d426ab06b6490be61782df9e360651783559aca629d
- SSDEEP 196608:aKt9y0xEMSc9+IL8nPZyaWV74hdTQcwSMiFkJw9IJF+m:a8LvD8ByaJhScFMilIJF+m
- TLSH
  T1B36633C1BE8A6770E18BCBB0510265BE32763FD2BD118C567BE5320C7E3A62619F5790
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2