23ab1423c142eafeb82803f8f3fe3a4c53077e030f3c14e0fa6cd360567773ed

General

Target
23ab1423c142eafeb82803f8f3fe3a4c53077e030f3c14e0fa6cd360567773ed
Size 7.5MB
Sample260802-cdbzdsbn4t
SHA256 23ab1423c142eafeb82803f8f3fe3a4c53077e030f3c14e0fa6cd360567773ed
MD5 82bc9d82e8e3b46ed40a35c922c7952c
SHA1 2c4e4f50a19bf7e10d5140e9e3cbc59b70881121
SHA512 3c4b226e63c44e4d795b553d6b6a07d7e8efc65effcf0cb07e8bab3beaef3f9e6a6745c47aed0abebb6745a669b06c16dfb199a1f6725c2539d69424ddc12ab2
SSDEEP 196608:skxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOZ:s+eAAUDCYlMKqPzvO2O+
TLSH
T16A863383AF6F2181DC383D827E3CAD358E9F75D24B6529252846BBDE9D044D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 12f91ecd497f83c9f33d5089fc8fed7dbf1335efb2ece7496fd4a720f21559ac
- MD5 9f34b2de41276b654ff7c7995a0e602d
- SHA1 320affb00a1e33dede1e89c02e07f4e41d6e6826
- SHA512 eb8c0d76c38327ec54c27396b0b4030fc92e9b04069e3f1f983f6937e88ec01cf42d2de06d047f372a6e67f188b36e10133ac18a552167602eb3b63382ca8f1a
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/g2:IA8oKhVeLwUSPVjqSwL
- TLSH
  T1938633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2