5ae01c53fbe1e3fdef8d44e91fec714b31dc86a8500f76ff17a43d2f28a20e37

General

Target
5ae01c53fbe1e3fdef8d44e91fec714b31dc86a8500f76ff17a43d2f28a20e37
Size 7.5MB
Sample260802-cg45casbnc
SHA256 5ae01c53fbe1e3fdef8d44e91fec714b31dc86a8500f76ff17a43d2f28a20e37
MD5 a0e125bba3fca5f9d93b8ce542103d8d
SHA1 1b7ae4263b84c3b2f00184b90dee2c3771b8e754
SHA512 49e6758edc95bd71b89aeea06851e65853330960c8bed4e3b101a6d0a5af9b5038e35a046df8d9c3e4ae409d9ae561299da21a7f06785d4bed8c413d39d84b15
SSDEEP 196608:WkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOQ:W+eAAUDCYlMKqPzvO2OB
TLSH
T127863383AF5F2181DC383D827E2CAD358E9F75D24B6939262846BBDD9D044D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 db1d199ecc976d0fbb1b78bf89da2d17f31344da32a81beb77968f55731178a8
- MD5 9177c4a3b96afec9162c654669c8f9e9
- SHA1 7077b0ba9eb061bc729184ad225bac93ae238bc5
- SHA512 8059028c1b8b6ef4c086c788951f637c7f0dffb48263b2f825659840ea8b2513cc48f0a86fe7a5b74426d56d27779c315bf1ec1fee224b685357307cc6f11f3d
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gZ:IA8oKhVeLwUSPVjqSwk
- TLSH
  T1A58633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2