5339d77854ca801d062dbb154cd812ce37b38f1ed5a44322325a681d83314f8b

General

Target
5339d77854ca801d062dbb154cd812ce37b38f1ed5a44322325a681d83314f8b
Size 8.4MB
Sample260802-dfphyack21
SHA256 5339d77854ca801d062dbb154cd812ce37b38f1ed5a44322325a681d83314f8b
MD5 881d8640161f5c90a2c6a32e32150f05
SHA1 03011570962b5ad6a052c3c1e638988ee0fc1dcf
SHA512 8c876043974fe0f4354589076d6f9f69c4aff3ca4a5c4a5ee33b8950c332ccda99b86aab456a0ddb7895c2285a386a6c952ac7595eb50b46c10dca31489dfa2f
SSDEEP 196608:6h+6u1PIqEO9ZUJObXws6tN4XuF/qQwKJesUxiqub2A7r437xbU9//:6ha17EO9ZUUx6tN4XuFiQwn8VP437xwH
TLSH
T10796338BB9D081BA3551FA459C349B06381035A7AF950DCAFF6450EAFCA879A3C473D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up007.msi
- Size 8.6MB
- SHA256 7a9bfbc6a670ec5d2d489e1c4a694ba50c807655d43b5f952cb132adb74e68ac
- MD5 953ec8e14a85f4066659d37fb7a4c51d
- SHA1 3d86506d2e5b9d28fa00c63153f9696e6d19d271
- SHA512 220a225f26195dc300e515244ea88490f480dc4a28b12e052e34029dc78f142cc1d22b5751949189756b2432bb7b558e9642261c8a19297d5d82b4cc5505a11d
- SSDEEP 196608:W6WTYIpbo0g4lvOuUdZpEXmPNkCM4X+I4Hmq+r0ARtMhnYJE/JDw:fwp/g4lvOuUdZpEXmPmCMTGVbMhnYk5w
- TLSH
  T1F29633C67CC52374D097C7B09823A62D39253FD4BF664C8ABFA87601AC717262977386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2