ee6cddbf22aa2783e7c4e6cf75a6c817a220b5d138b92cf0975b1ec6c6a57e05

General

Target
ee6cddbf22aa2783e7c4e6cf75a6c817a220b5d138b92cf0975b1ec6c6a57e05
Size 9.2MB
Sample260804-r3nrtazwav
SHA256 ee6cddbf22aa2783e7c4e6cf75a6c817a220b5d138b92cf0975b1ec6c6a57e05
MD5 76353483aaaee5e6a6aa36a2935693a4
SHA1 b9fb27fe9e55edf565a4408c42baaa65ee556829
SHA512 f2df94cc5d1a662c0a5030a196798a40582f3e95a9743e7a8b0d0e25f46dea9b96bbb966ddb1b7bc6d51b78f53d2b7dbf04f565ec5d2c5f4a16abbad1e82b451
SSDEEP 196608:vID/eSmegTf6ieeYwyg1JJfhMCSWVqCjTHezKS:vIDe+EQuyGxSsbbezT
TLSH
T1C4A633D898ABE979C1778B9004CAAF126BD041EC4CF25525232ECF28DEDC864D6E7753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c006.msi
- Size 9.4MB
- SHA256 a0bb54b4de5b0fe8128bbcb5e01f2aa69ac710982cc01e76fc1c7d81f5149059
- MD5 8a620cd8e2d395ad1d96fa86185275d6
- SHA1 75ef40b320c7867715382a065abb3d87e863ff92
- SHA512 d5986206a1029b73d311530ac9c1415b3f5178deaf9323670eb7ad5af387deda1a9b7c302784e92f79285e1372bc8efd03196ac146c83b3d2ebee02574d5d62e
- SSDEEP 196608:KTMkzZH3Wd6cQeYn/C5RhM4N9DNZhG+kwl+upHGrC5:KgkzZX66AqyM4TZkGHGr2
- TLSH
  T1EBA633D8ACCB67B1C09BC7B005426A2D73643FC47EA2492B36EDBF086E7652454F6346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2