90628b1896aae9eb6df8517a6b8ba0cbdb63ca57983bcbc3a21305839e6bc2a3

General

Target
90628b1896aae9eb6df8517a6b8ba0cbdb63ca57983bcbc3a21305839e6bc2a3
Size 6.9MB
Sample260804-nkawfsdn3v
SHA256 90628b1896aae9eb6df8517a6b8ba0cbdb63ca57983bcbc3a21305839e6bc2a3
MD5 734520b98c8c79342e968e96d9f65a2a
SHA1 8a907ff5da56631167c56ce4576fcfb5d78f77f7
SHA512 066e7a60dbb5ff4dd7d72fe851a8ab1507d8d4313f23f5526a14229aa041f7d1b50671bd4f0ff28fd2d82424e02630127f468153de3aefd559eaee14052ecd7d
SSDEEP 196608:HEL6qipXt7yPHUipI/Qm2s35K4xdKBLDnLzjM33WGe:Ii92fUF/Qm2spK4xdaDYnW9
TLSH
T1A176330201997BB7475A06AA2FB39704C5013D49F801A5A9C8EBBB4593F3B9F1DC39F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c009.msi
- Size 7.1MB
- SHA256 738dfeccfb0e2bcaebc591a376c3c155528f76ad0ac022e73b9c1b4b332bccba
- MD5 36ded6c06ff8cbffef90503f90a3ef15
- SHA1 129dff3c3f5ab3c52dfc0e44c45dcf10ab214c07
- SHA512 71f9cfb656420f3a3ab6249840077a31ff5b183bccb2153f75a86e7e4240897963552d3acab6b26b0dca0ef40d707cadecde171bd5fb5ea31930d0f81ef91f5f
- SSDEEP 196608:QUTss0UBxNzE3NUsTsJtR4Jy4QrZ2Y9DCztRZvpNeX3Uaf:QUTAg7gdUV2Jy4Qt2Y9DuP6HUG
- TLSH
  T1DB76338669C47772C09FC7751A53626CB0293FC6FE624C07B9EAB6004AF372A54F2785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2