35424afa8f512fd351db9c3b7334ab389bbeaa47648acc2859adaba22a12f1c3

General

Target
35424afa8f512fd351db9c3b7334ab389bbeaa47648acc2859adaba22a12f1c3
Size 6.9MB
Sample260721-pa1jsshb27
SHA256 35424afa8f512fd351db9c3b7334ab389bbeaa47648acc2859adaba22a12f1c3
MD5 42bf2d2e81bf68deb4ed33681412b27a
SHA1 88a7a4fde26675c0e9799292b20ad57291728bf7
SHA512 26958858cfa5a7f5b4a47b59635b5cda331dbdd6a86db792e27f1129d0788138dfbdad6337805c797dad56cd81321ad05d1ce745a2308177e2110c26ceb11f18
SSDEEP 196608:FPDn8T6Z8mVBKApnG1QjjauUqlmneoHs886AXU1/:lDn8GZ8RAtbjjpJlY3TcUZ
TLSH
T1CD76338F5C28BBCD5238075B95B69772E7E3940EF921CB7D3D608299E5E4000E27E2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appstup.32.0.6860010.msi
- Size 7.1MB
- SHA256 33f3a7cf9880763287bb6a6c7cd351915e77526a491275d3b42b34984f7be6c1
- MD5 365d7711f646cf797f5cc6a6129f36ad
- SHA1 b07aa21fdee90ffec24e74810dbd1f34cd719611
- SHA512 b62f6a267c0d3eacde40b5784593b3fa0aa752ff339a748bf41cf65da100cada92ab05d72318b40bef2e81240c0a054ca8c6dad4b4876a44bb79fec456e51751
- SSDEEP 196608:DlZWpm3UJYajnGob9PXM1SqdKje4fOYkWqjGFV:ZZ+jJYvo5PXyvds99aGn
- TLSH
  T17376338A6C896378D09BC3748063B36EB2727FD5FE328D1B3AD87B185DB211411B7685
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2