ff78c89197b55349978a8ae32d4241f1ad7ba042e5984f11a75eacb30fa343b1

General

Target
ff78c89197b55349978a8ae32d4241f1ad7ba042e5984f11a75eacb30fa343b1
Size 7.1MB
Sample260804-sbaasashnb
SHA256 ff78c89197b55349978a8ae32d4241f1ad7ba042e5984f11a75eacb30fa343b1
MD5 9a0e3bb9c234fd675d907b06a9267f19
SHA1 38f69d6f17cbdb94667551b6234c9c35a5541158
SHA512 032a808a60d29aa19c8c989e4abc51cabd0463d82698b88c8bdc7beaf7c390ab150410ed253ca90ee2d138aa3761d937533d375a6b01d69e63434d9e9eaeba5c
SSDEEP 196608:BcEnAospqeeZedXYYp5vNHeKdU1hZc7X4o6Lj:pnrheeZqIYlVdUO7XN6H
TLSH
T1F87633DC1B95ED1B1AC0C627BD8EE01BA69C4C3199F6DDAC8391638C77B2971A11D833
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c005.msi
- Size 7.3MB
- SHA256 b8650867b37301cc028a3b2a40f07d7f5cb19fbf5ebcca1f125ab80a84c68e4d
- MD5 7316c79b2d92cb57f54784afb7ae8e10
- SHA1 5b1253f89893d3f45eebcbccc2a67eb6557dbadc
- SHA512 b69ab6c72158a09a8b5048ce0f0c800e82d0fe99c8c8b4c7f7b04d63b85d38807345d41a6cf1aa44a283cbc146d339fdd8747e91412dba6562ed5ca21fad093b
- SSDEEP 98304:cQ9Z0Uu1Hgeti3AjLXoCyUXkego6d5V1NHe2vzL7QkuD9HcoaNwOd9EGC6PccB:ck3e2A3owXke45VrHeIfUJ5HcvZs6VB
- TLSH
  T18B7633D46CC6B736D6A7C3B1988B652D7A293FD07AB38C0E77E436042E333255279612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2