875e39b2a5e407be0f18a53f1bdaf0ef56fee721b7dbbcc861d6f604aca90d70

General

Target
875e39b2a5e407be0f18a53f1bdaf0ef56fee721b7dbbcc861d6f604aca90d70
Size 7.5MB
Sample260802-bh97babk2z
SHA256 875e39b2a5e407be0f18a53f1bdaf0ef56fee721b7dbbcc861d6f604aca90d70
MD5 5fa960a0c872a07eef8b7789a0abc81e
SHA1 60c879dcee02473e769f0624fdb5aa4f58a5a80d
SHA512 6dbef09960169ab0f73d49963a681b41e6fe79c3bd033d11a36b22f694f970ebf6e2d4d56ac544f45c83cd4f09eb04fca79f8cebf724026e2831f346d7bb7d00
SSDEEP 196608:ZkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOX:Z+eAAUDCYlMKqPzvO2OK
TLSH
T1AE863383AF5F2181DC383D827E2CAD398E9F75D24B6539262846BBDD9D044D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 2318c6651c9baa8392d43931466a89827b626bc5319f40ff3e5e61b6c51d9b1a
- MD5 cf3cd0a89f8c275948620e47cb6bf60e
- SHA1 b2a09b5a794772639908ea73329a4ab092265498
- SHA512 1fb2eaea2313ac7b73b2879c756f1ae3b68da9ff08d28c48fe56716d86e00696b0c0ac840201887c7c6912f84aceeda6c3499f0a36874357a0215400e950f51f
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gw:IA8oKhVeLwUSPVjqSwp
- TLSH
  T1A28633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2