bd7ff513a32288c4751a5533623c8732869190d92bfada763cac18a82e52cafc

General

Target
bd7ff513a32288c4751a5533623c8732869190d92bfada763cac18a82e52cafc
Size 7.1MB
Sample260804-ssqzvs1th1
SHA256 bd7ff513a32288c4751a5533623c8732869190d92bfada763cac18a82e52cafc
MD5 1a6b3230bfb14d8fc912b1b06175eb27
SHA1 10bff94fea6fa977be06aab7f3c5c761ab3d186a
SHA512 9e4adb589c77ae172344402e558039ddfe6bf9773c9f7f0bd75d5066582042cc6ac7f75956c56bdd30973e17076bf89e74d1315a1a00a36db41ffb62ece896cc
SSDEEP 196608:2cEnAospqeeZedXYYp5vNHeKdU1hZc7X4o6Lw:onrheeZqIYlVdUO7XN6c
TLSH
T1CE7633DC1B95ED1B1AC0C627BD8EE01BA69C5C3199F6DDAC8391638C77B2931A11D833
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c005.msi
- Size 7.3MB
- SHA256 22868ac40d52ccbefdc81210c1de03ae013c0d2e0e2c66d85d6d7242b228f925
- MD5 e3ae843e3f473191b6edebee6db07fdb
- SHA1 050683312adfe1d814f2f19a0d3976b40f70b847
- SHA512 9db3e85f4c564aca2850af554445c8dbcba24e66ebc79f09b84cda715ed6285689879ef457a0e83db1c68cd1fecbb207bcb85b3c856cb771a3c5ea891d7568f4
- SSDEEP 98304:cQ9Z0Uu1Hgeti3AjLXoCyUXkego6d5V1NHe2vzL7QkuD9HcoaNwOd9EGC6Pcc7:ck3e2A3owXke45VrHeIfUJ5HcvZs6V7
- TLSH
  T1E87633D46CC6B736D6A7C3B1988B652D7A293FD07AB38C0E77E436042E333255279612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2