f20196e0304a93093a0799b797e121a5d3b7f4487f7dfad30527f4b88106b6de

General

Target
f20196e0304a93093a0799b797e121a5d3b7f4487f7dfad30527f4b88106b6de
Size 9.2MB
Sample260804-rz2t9scd49
SHA256 f20196e0304a93093a0799b797e121a5d3b7f4487f7dfad30527f4b88106b6de
MD5 4feeed1791b03dde5c8524509bf9a9c4
SHA1 0b288942ed4429215d2239387547e944b411d5e7
SHA512 130fddf8458e9ab90119f6406a250beb65e34fea25eca9b0890fb92d0603c8bf5baf8f2f0ca97ddfd5a0c8b9dc7b4d6e57ea5f697539fd014cafa29209ce451f
SSDEEP 196608:AID/eSmegTf6ieeYwyg1JJfhMCSWVqCjTHezKe:AIDe+EQuyGxSsbbezz
TLSH
T1D9A633D898ABE979C1778BD0048AAF126BD051EC4CF21525231ECF28DEDC864D6E7753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c006.msi
- Size 9.4MB
- SHA256 e27c7b8a6ef18fbda4537009995f5d2bed78507c6d4ee8e2f9c418b67853c1ab
- MD5 29d66c720a01b9b17c28e2de7527ed23
- SHA1 4fd1cb511a04831f93ab93cff3b31b04471340b1
- SHA512 803c9ceaf88ebc665cb2b3e924a03db10979269cb2ef60e84ca0a250074e74c4c4061ceaea111ed26df093c90a12db4180894db45ea7e38fe2eb2e99a8d3c203
- SSDEEP 196608:KTMkzZH3Wd6cQeYn/C5RhM4N9DNZhG+kwl+upHGrCG:KgkzZX66AqyM4TZkGHGrJ
- TLSH
  T1DBA633D8ACCB67B1C09BC7B005426A2D73643FC47EA2492B36EDBF086E7652454F6346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2