29534f53f6c181bd26ec33a658841320c874cdedbdadc88fe9909a80cc3344d7

General

Target
29534f53f6c181bd26ec33a658841320c874cdedbdadc88fe9909a80cc3344d7
Size 7.5MB
Sample260802-cdbzdsbn4s
SHA256 29534f53f6c181bd26ec33a658841320c874cdedbdadc88fe9909a80cc3344d7
MD5 dac906062e5d1cfb9112331d855c42c9
SHA1 d1af92dd0816ea790206bcf0f8a2efaca4725228
SHA512 f34fb38a95c8fa22271e4d60df98e376b2ae17297dd87341b1600ef87fdc97bccf1c74d3e19e9855602dc722e95be01d3d8e1acbbfd28fccba6ece9cfd9dfe4f
SSDEEP 196608:QkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOW:Q+eAAUDCYlMKqPzvO2OP
TLSH
T1F8863383AF5F2181DC383D827E3CAE358E9F75D24B6529262846BBDD9D044D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 9e8df62d80ffbab44f53c3060e7a623f35f683fc6a080dc3071acdf259cbdf62
- MD5 6660452337e8312396c8b67ce2b092b7
- SHA1 f0e2bfc6b0ecf16c210c90672c7c51d9abce44ec
- SHA512 a1ee9253b38774e2a0a98183d5bd6116a4d0b8784e459ca8eaac910fd73a328dcb2e70d82f9147f966203a11b1efb2b48585d3d93bf3d2059e030f8e503d95bd
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gu:IA8oKhVeLwUSPVjqSwT
- TLSH
  T1D98633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2