fb30001d5331db38e0237863a0329e3edd6880dd91de83ed6de785fd9cdbfd01

General

Target
fb30001d5331db38e0237863a0329e3edd6880dd91de83ed6de785fd9cdbfd01
Size 7.4MB
Sample260802-dkkesatajc
SHA256 fb30001d5331db38e0237863a0329e3edd6880dd91de83ed6de785fd9cdbfd01
MD5 861ed826d2fe70e5fbc38532cc2e368e
SHA1 22c4bb5e4e460a88df52621e57b56505c41594ec
SHA512 857cb90431280c8b5f9f556ffd2f84f2f7371651cadfa4dc6ae19d7e52ec8597b98707ee9e626b4ce826c32a7a1944cf2ed35be78238859c1d70db58b92bba9e
SSDEEP 196608:vUF//apPX1upQFr1M7hQU6JO2ujY/RDHNYlI+cpo0zQAlL:6//aNFSOaGU4BPHn1BfL
TLSH
T1177633BAD3BB3CFEC15A53110336912B6CF6A1D8A83DFE881397C0A90555DE68F06764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up006.msi
- Size 7.6MB
- SHA256 d03f656148aa28ab23b693f9c3cf7938265f7792df679a728feea59b3612c63f
- MD5 37b8dae025c2a39cd4e44727bbf6d5e3
- SHA1 dc1cb7c68b42e9f1b28a3f186c021d899d28525c
- SHA512 bd6ce9bacff57973630c10fbfeff78c6fe36d726193210d2becb44ce79d5d3600522679705cd06ada85177191450f517c9bacdbc1160dd9bc0c2d131494b7870
- SSDEEP 196608:ATacFhja9PR1uTUFL3WaNNoT9n7gle0IzEu/euls:0hjaxXQcWaSnZNZHs
- TLSH
  T1B48633E5B4E93B74C08BC3B14117613E706E3FC4BE79AD4673E9B5140E72A264A36398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2