a4419fb6482d6797903e3f225530195a4bacc9270da8ea31e056bfc23695da7a

General

Target
a4419fb6482d6797903e3f225530195a4bacc9270da8ea31e056bfc23695da7a
Size 7.5MB
Sample260801-zzyrlsgl51
SHA256 a4419fb6482d6797903e3f225530195a4bacc9270da8ea31e056bfc23695da7a
MD5 38c43588e56413fed3e5498b5944fe1b
SHA1 60ffd314625f9a2ce6398101ecf4104310ca8350
SHA512 8f97a39b1c47d5c32aa46c9446618c84b3e567d43a2942f41927fac1a3104040ca04f6b8146d26bcc6146eb7146dad141d866b8f328fdba928618f4d72d2e4f4
SSDEEP 196608:FkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOV:F+eAAUDCYlMKqPzvO2OM
TLSH
T117863383AF5F2181DC383D82BE3CAD398E9F75D24B2529252846BBDD9D044D3516B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 ffd97ffda7bb8fd581daa21ac566330a4c56861f5f4aa9afc3571f5eefa3e08c
- MD5 368717708a0e796bc8bf33ada5713a2e
- SHA1 2d113e5dacd9da4d7875f228d3d39687c216e22a
- SHA512 4656ba99be3400c4eca81816ae305966671ca6d2d77be0c83bc38a2bff79f6d44f942ffc4ab223ac9773860bc8ea2c692b3db879ea8f50c71c4ff33272e13204
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gj:IA8oKhVeLwUSPVjqSwq
- TLSH
  T1648633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2