b6a971176039d1af0b20c05a0dc74469df3198172b7bdac35608389e5a9611eb

General

Target
b6a971176039d1af0b20c05a0dc74469df3198172b7bdac35608389e5a9611eb
Size 7.5MB
Sample260802-cngydsscka
SHA256 b6a971176039d1af0b20c05a0dc74469df3198172b7bdac35608389e5a9611eb
MD5 17d12c4971f0dba3050f5bf5b1f2f702
SHA1 7ffa1714482b086509d24a7e8ffe5bff1c1899ea
SHA512 3b641c2171d355c296b0f665f7ed77af8d1f91eba1d36d2ea00267cd02c84baefb314c38c0cf25ab9cc5f694179739386c189927cbb0ca7a0bf789fe1f582b59
SSDEEP 196608:zkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTO6:z+eAAUDCYlMKqPzvO2Of
TLSH
T1F7863383AF6F2181DC3C3D827E2CAD358E9F75D24B2529262846BBDD9D044D7512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 7876112c8a8180441a29e1873a4c311c5d56791b8cd4e616301e30bd9cc2cde6
- MD5 24b6b7fca814589903c23d2b2d0c510b
- SHA1 6a774e2f12623ebdee49b6f388a9afe9aab6f8de
- SHA512 f6f878b23f2a6bb8f19f5987b1efdfefd66e4997fa20bd7c7a4015b35b10f668fca69963acc77a5537c4a35d9749f9264e60af566dfe455a6bd8a703f1d90059
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gI:IA8oKhVeLwUSPVjqSwt
- TLSH
  T1AD8633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2