02a3faaf2d0f348e88c953f7c899ce569043338a627299cfbac374b941d2e096

General

Target
02a3faaf2d0f348e88c953f7c899ce569043338a627299cfbac374b941d2e096
Size 7.5MB
Sample260801-z227taxyev
SHA256 02a3faaf2d0f348e88c953f7c899ce569043338a627299cfbac374b941d2e096
MD5 19f79fc9e8111acdf0de59437dd7def5
SHA1 b39950564695bb1c096a3b49d07461e6ed74d60b
SHA512 74f7a94d65e473999821dcc0763958257626d259d3965ebecacf0f5d2dd30df09462801701bf037ae3bf68c670e26a8632632726b7e1cbfe5c871c597be51328
SSDEEP 196608:okxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOl:o+eAAUDCYlMKqPzvO2OI
TLSH
T191863383AF6F2181DC3C3D827E2CAD358E9F75D24B2529262846BBDD9D054D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 704aad8329d536e5319a816c0dd84049b59c5d17affbfbe85e36cd0316f20466
- MD5 2233c276c5bf2e9a0903a4800f0d4ffd
- SHA1 4d15f47164fcec91164ebae58b7c61e8ee9dd82b
- SHA512 19f92be9b3fd223179ffe370bc0f6eae85e949c32dfeaa328f6a15cfb08d9b93a76122d567e5e96d5628ef98004d7a29976c1702754d5a2bdc1336ac30143773
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/g9:IA8oKhVeLwUSPVjqSw0
- TLSH
  T13F8633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2