35bebc01b461f450ee57b94b3d0aafb1c22a227cd4c45d5849cac4ed337a30aa

General

Target
35bebc01b461f450ee57b94b3d0aafb1c22a227cd4c45d5849cac4ed337a30aa
Size 7.5MB
Sample260802-cf1ersbf68
SHA256 35bebc01b461f450ee57b94b3d0aafb1c22a227cd4c45d5849cac4ed337a30aa
MD5 5be50f31125671566f6d8a4080e7e26a
SHA1 159f3d32962ef36893d2e695f9dafa56c081d2c4
SHA512 9b4d04b0a50cd8bee673ac2911dce4020246d80cd2a5e23106c7e4e4f7546b93f4670302188157c8fd2404b7297e361b0014b86db66a6b513afda8a3f0b2ad5d
SSDEEP 196608:BkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTON:B+eAAUDCYlMKqPzvO2OO
TLSH
T128863383AF6F2181DC383D827E3CAD358E9F75D24B6529252846BBDE9D044D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 32f2f52744b88d3acb4ce359ec3110dda756a461c0962c3752b44814d26d441e
- MD5 6a6bd034658e40592366d82087b6d3c0
- SHA1 6e50425191df03fd6d7bc9e619ad84b3ecf0b4ab
- SHA512 3018c3073f2df658e1b06534a51c3460c62ad708c08ff5b0b83347a82f4156477a469d5cfed170d8f65f07f0a314dc6e5ff1f43ddc59ce0a586f57cda01902ed
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gr:IA8oKhVeLwUSPVjqSwW
- TLSH
  T1898633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2