3a212229e26b10c8c16b79b1e6b6a83938a661fe544c6f937d556ba1db8781df

General

Target
3a212229e26b10c8c16b79b1e6b6a83938a661fe544c6f937d556ba1db8781df
Size 5.0MB
Sample260721-wlfgbsde35
SHA256 3a212229e26b10c8c16b79b1e6b6a83938a661fe544c6f937d556ba1db8781df
MD5 524fd1fe2ed5274e32eec7ea35e637df
SHA1 a5374373456d0a9fd38eb7f4a07450de9996eb7e
SHA512 3957f660c8bda64d9590aca261c37c238e1e98c5beaa2e8a2eb60203f1216ed1f60081ac968e76fc2cc65d507b44c9c83f454440d8128797284c278929c52448
SSDEEP 98304:cBVAqlv0HhYlefFmzQHbwSJK9lw1+aul64Jeb6ZzxZKxwQZiEjJVfYRR:cBVASv0HGlefFgQHb5ia1JulgtjHYn
TLSH
T1BB36338A7276035AB71495F03C48D39A9A11291767BA3C085D77FA786737D3E7E3808C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appstup.38680021.msi
- Size 5.2MB
- SHA256 ecf5e648b657ff6ded0cdd61e3867f0f3632eb811458dc8611d010a85a70f414
- MD5 26976b3b96cd10b4be7b5a6da8cab6f2
- SHA1 db3c01ccd44c1991a1326b49adab7c98d7d02cb0
- SHA512 04f505d2f4f12764b08283e58f04ba1b34ffc6bdd5e42765358018f63f73622e2db5755acaaa6b81af70f7e2dc29aebec955a660a8f8acdc128cb974dfcf3b94
- SSDEEP 98304:+l+gXB+jbAePeJazb+wJs/dIVEaWXUhhFTTeOrsppOr3ZyYxxWa5+gRppPK7q:+c420SKazbdGSV7WXchFy8TBRfK2
- TLSH
  T1494633D6B8A62371D147C7F10182B57DBE293F42FBB64C19365D7A205E32B292B35388
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

persistence privilege_escalation ransomware defense_evasion discovery execution trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2