9e4b37544a8a2354db85070e9aa161e349731b0e81ac4efa20d887c0374c20e1

General

Target
9e4b37544a8a2354db85070e9aa161e349731b0e81ac4efa20d887c0374c20e1
Size 7.4MB
Sample260802-dl4j2scl2x
SHA256 9e4b37544a8a2354db85070e9aa161e349731b0e81ac4efa20d887c0374c20e1
MD5 03dc2210d08bbec642f88743a37e69b5
SHA1 835853c28c982b8373ff54af5ca202c8cc97edba
SHA512 4916808214f166bc91fb0b718a5702889ec0afe35a8a378651eb3f0dfab1946e9095144f72e760655ad63a8d495f87e92d99658e11c466ea91af0c1bb390f583
SSDEEP 196608:LUF//apPX1upQFr1M7hQU6JO2ujY/RDHNYlI+cpo0zQAl6:W//aNFSOaGU4BPHn1Bf6
TLSH
T1417633BAD3BB3CFEC15B52110336912B6CF6A1D8A83DFE881397C0A90555DE68F06764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up006.msi
- Size 7.6MB
- SHA256 a751aabda3536dd2de07d503baeb80a58d569b85b8b0fca2e33089e96bf32ecf
- MD5 8b440a296b47ca2f7643acdabae94e6b
- SHA1 b1fa2a9a72a07b6f6d321a22439289f8b7376563
- SHA512 8b0b78f6ab1b78b414c1c3d5d0552b28e4a51cb6aa3833ba507545db698bec633175c663b0a2e0e7bdda594a6d280858bc34466733a02dba9ecb66902e902608
- SSDEEP 196608:ATacFhja9PR1uTUFL3WaNNoT9n7gle0IzEu/eule:0hjaxXQcWaSnZNZHe
- TLSH
  T1AE8633E5B4E93B74C08BC3B14117613E706E3FC4BE79AD4673E9B5140E72A264A36398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2