81baec67e091d3d263136f76e2cf925297eb905b3dd8d7a08bc9d2d507c342ff

General

Target
81baec67e091d3d263136f76e2cf925297eb905b3dd8d7a08bc9d2d507c342ff
Size 6.1MB
Sample260804-y2wjlayfrf
SHA256 81baec67e091d3d263136f76e2cf925297eb905b3dd8d7a08bc9d2d507c342ff
MD5 a0bf411542142bd12c02a9ae0f9f9d54
SHA1 1fed37ce7cf5768ad900913064ce2f1c0aa44957
SHA512 32081368e34456f6e85749f2ac1951fe0e2bff13303bccb2d5e2ce1ac73578a5450bfc0b93dd33c05675103c246e332294f7fb4a75d8a3a58594136abb85804f
SSDEEP 196608:a2WHrzGHZ2o1Z4RSnDqv5bAxkH9+/3YrDWsxsU:a2Wc2oz4RSn+vZA6U/3sxsU
TLSH
T1285633CAC8CC4B4973D475C6E97D275A6323FA5D1CC10B49DA843A7BEAB8D5038A423D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  inst_s0t011.msi
- Size 6.2MB
- SHA256 1121acf455a0dbf6f2f5c18feff943a32bfdf3a70b15b52f8b61946435bb5a09
- MD5 682689499fe273b69eaac5d062ca7d78
- SHA1 bd8cce7146878b9f5c9dab2a82e971c60e5fb030
- SHA512 de4ca12a8029cd2391204457a13aa46645507c4788a44eca854bf1642b8abd6f5d2897bf699a154ee115933e38bde986330136327d1629aa45f610c907b1a352
- SSDEEP 98304:ba3nM4/QH8dggU5NSj1Cj2kU0KGn1rkdXXaIUyFBNCNxbM0L6+x4DjHYT3pPCNyh:bUMWzWR52O2beiEHynQ1x4DbY7pq4JmG
- TLSH
  T149663395BCCA2774F057D7F08556323E722A7FC91F228D0A7AD8361C5E72A226CB1358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2