2376be85842190bd049069522d8639468f32748dbd07446e2882e8fc382f2ed7

General

Target
2376be85842190bd049069522d8639468f32748dbd07446e2882e8fc382f2ed7
Size 7.4MB
Sample260802-dl1s6acd32
SHA256 2376be85842190bd049069522d8639468f32748dbd07446e2882e8fc382f2ed7
MD5 ba2ba24697fb88888a8ed2d31761c853
SHA1 9a67f9e50597e9c649b805b0561d42b51b6907fb
SHA512 d652a8d9694e1c601a510ad8b3e7454628a502036db5e6957f79d27f3591c2d5a918a25f4965bf11fd07c547c121a2e33b7d1cf4cf74c78f5c4c1d2ef11a2007
SSDEEP 196608:YUF//apPX1upQFr1M7hQU6JO2ujY/RDHNYlI+cpo0zQAlN:V//aNFSOaGU4BPHn1BfN
TLSH
T1F97633BAD3BB3CFEC15A53110336912B6CF6A1D8A83DFE881397C0A90555DE68F06764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up006.msi
- Size 7.6MB
- SHA256 81cdbaf075e57efb69f339248272b83355f457b96a7b072c78744382a6cd18f6
- MD5 2fc640bcdf97009395c8f77044a478b2
- SHA1 569470e880ac430f279f4d8c4f7f03238afe1e5e
- SHA512 34922b9ee720d5f0bc554c8d5544e3fd89a0a7cfffb60af7aaecce3daf0171243d21b0f5f152dd86ed43a56a0be580fd5967d085f470f0db25988d230dcdd7f7
- SSDEEP 196608:ATacFhja9PR1uTUFL3WaNNoT9n7gle0IzEu/eulc:0hjaxXQcWaSnZNZHc
- TLSH
  T1718633E5B4E93B74C08BC3B14117613E706E3FC4BE79AD4673E9B5140E72A264A36398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2