02ac3fd011003b4fe5a4bcb41f99121e5e18694df224e2c53a023b5163540b8e

General

Target
02ac3fd011003b4fe5a4bcb41f99121e5e18694df224e2c53a023b5163540b8e
Size 5.0MB
Sample260802-g3mjmswflh
SHA256 02ac3fd011003b4fe5a4bcb41f99121e5e18694df224e2c53a023b5163540b8e
MD5 646b149415b04055959685197dc371b0
SHA1 62da26a15a2eb6a8e8bd5f0aed87a8c865835491
SHA512 ec3e63adbe435ec49c229e3657a037bc2ac4e37fd9140e0966c25a8938264362470c63c238dbbd3c210c864145bc251358237da92b69d8ab6f53d1e2d18d6458
SSDEEP 98304:GQ6YIEPHFMnY7nG4qLP4IkeNNZ2G9a08u9A/p+Gh+Qy4QYiax9GOvFkFIoY6E1t4:X6bEPlgY7fqLIg2saLu9A/vYQIYXxE4O
TLSH
T1613633E9750F322F3057F3919A26A0D7D688BBF78065E116C585F56B8B648B13CA03E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up010.msi
- Size 5.1MB
- SHA256 f0f63d5ca0f344b56ba78fee824b392585f715b5d8f29fdebc230e1c81f3b7ea
- MD5 e5e53e4f867208ee97d73eb127b6f434
- SHA1 de04eca16f94e3c0c86cb25d2344b4a35d08230f
- SHA512 da4be71c04c05d8d9f030bdd30e1c84893c0ac24d3feaccd837b2d665de440d7b04c8155e1c3965fa293f3f37c4a24cca86b177d4d458e592df817ba6aac2dde
- SSDEEP 98304:Ov2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9dYRTuNwqC601W:g2nuF8NCeEI69grA1YyYpFvaKNCdXq+W
- TLSH
  T1D54633957C8A2738D087D3B0031231AEB1197FC6BE339C17BAD976198E72A2664753C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2