85852c50ffd34711de83f9b480c84699f03f01e87d90794071abebaf51944040

General

Target
85852c50ffd34711de83f9b480c84699f03f01e87d90794071abebaf51944040
Size 6.3MB
Sample260721-thvqqscb64
SHA256 85852c50ffd34711de83f9b480c84699f03f01e87d90794071abebaf51944040
MD5 1df5df276e76c3342b334aca783bf71e
SHA1 01ef179503755a505f374d0de4dfdb70e469cce6
SHA512 e97b20ac03422e41ecb5c5238496921d36f1d07137626933e358d05d539923c0eca7659966ac7f608acd8c1137318ab6c63d488479ad3dd77cc54630befc19ac
SSDEEP 196608:DlPR2npMoZB8UuYoFPBphT7DsgZnrWcUbAX0mF:DlPQpMU8UubFPhXD7FrtUkXR
TLSH
T1FC663368E5005ECB8D4BC75BF1402958BF5340AEE271B5A9118C28FC468C4FBD2BDBE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appstup.38680018.msi
- Size 6.5MB
- SHA256 6ccc9dd2c446aad85e4cb13c33343e45da723aba4f0c438a8fd4170942edf584
- MD5 281e9450530b579225f5f9f429b3ab19
- SHA1 dea836550cb77b57838faaa16f303038454102a7
- SHA512 9aa37ebcf7dd506e3a3912bf8f99cfb741b05649387da05b9746df994eeaf87b42ed577ef02053c3ea4f537038dd38e54aced6cd12f131179d63293c09b83d24
- SSDEEP 196608:PjLZalfm0LnMkuKooPN5oTCMVBXkOzv1s2wbUX4ug:bLsfmYMkuK/15XMrXJT1fwgXu
- TLSH
  T1506633D8BD856FB0C18BC779A101286C7D393FC9BA72AD0779CC39580D7422686B978D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2