ccc301b0a458a70d578d9a41e76573c03ee3305ca5b1f575ccb097d8bb99c936

General

Target
ccc301b0a458a70d578d9a41e76573c03ee3305ca5b1f575ccb097d8bb99c936
Size 5.0MB
Sample260802-g73reswgpf
SHA256 ccc301b0a458a70d578d9a41e76573c03ee3305ca5b1f575ccb097d8bb99c936
MD5 13e6e7497075f6cc6f8481b595cabba0
SHA1 c4b1fedbb7728096c7163d168adbdc0a5ca713da
SHA512 a9c68ec4d0e0e5712a043336c074cf3bbb714430ad7a567b64c8c10002bf92858357f39334126fef5cc3154c7144b24d0e9de89b31c2a326f3d82261dec78409
SSDEEP 98304:iQ6YIEPHFMnY7nG4qLP4IkeNNZ2G9a08u9A/p+Gh+Qy4QYiax9GOvFkFIoY6E1tx:b6bEPlgY7fqLIg2saLu9A/vYQIYXxE4H
TLSH
T10A3633E9750F322F3057F3959A26A0D7D288BBF78065E116C585F56B8B648B13CA03E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up010.msi
- Size 5.1MB
- SHA256 54fce0aec119beb039d8af46262b5623c56a6dc352dfe8abb40d67dd9b4c3f04
- MD5 476f92c864f8b36ac63086c05cc6dd9f
- SHA1 33d660f88ea307852903dbde7800f8319b864b5d
- SHA512 f31882a6bb95fab69c39d3d53b51888745e1000d2859638bc480b20fb2ee1331e34970df11f5baee93e6cd190692ad9f5304699fd76bbad960d8334018c058ff
- SSDEEP 98304:Ov2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9dYRTuNwqC601j:g2nuF8NCeEI69grA1YyYpFvaKNCdXq+j
- TLSH
  T1484633957C8A2738D087D3B0031231AEB1197FC6BE339C17BAD976198E72A2664753C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2