c9ab248dd3309339b660809e3238848fb3a6d57be908844cbd801a63722ba2a6

General

Target
c9ab248dd3309339b660809e3238848fb3a6d57be908844cbd801a63722ba2a6
Size 7.5MB
Sample260802-cq39eabp6t
SHA256 c9ab248dd3309339b660809e3238848fb3a6d57be908844cbd801a63722ba2a6
MD5 198be408c38163f15197612199e6c02a
SHA1 3413fbe49b47b64ca8b455176b4156b7d22d8af1
SHA512 4b3789987049ee7e3fa47f9d878865d54051d6e69b4e610429919cb73d1e7733cb998fde642a2228661abd33442c916ada111d105c1df320dfb194f8acd54732
SSDEEP 196608:ekxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOs:e+eAAUDCYlMKqPzvO2OB
TLSH
T10B863383AF6F2181DC383D827E3CAD358E9F75D24B6529252846BBDE9D044D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 19695e8020379469a37795f2a8afadde9cc45665985f0ec30ea98142b197f5e4
- MD5 b2c81ae5735a9d0b89fe9be4f1c05f8b
- SHA1 857db2bf0b29964c21f192b0e483a413e979b164
- SHA512 fe5440c6eb83e00c2fad1f96f6f78c6d229fbc9538bf42cfc868e3f5eda1b6d5768e7fc372aaff9d6469197bee0ce8a5a658e509e43c187fb585bbfd0382e26b
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gy:IA8oKhVeLwUSPVjqSwX
- TLSH
  T1F78633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2