d882aef6a5db3e12c44c4c6ef4b7ea16e323c731be3069874388f4742004580c

General

Target
d882aef6a5db3e12c44c4c6ef4b7ea16e323c731be3069874388f4742004580c
Size 5.0MB
Sample260802-hbc2kawhld
SHA256 d882aef6a5db3e12c44c4c6ef4b7ea16e323c731be3069874388f4742004580c
MD5 e350d1d8a133921b9bffbea40d2d03a6
SHA1 003d6f25b8e2653cf9001c650b1bd5f550c0a74d
SHA512 d25f997fb4027641a3eaeca31ed409019f404188b2cfeb73fcd9b7d087e3850106b072d686a4c6e53f301711f24d39e802af98d6f038923d4d26fde27875e8f3
SSDEEP 98304:yQ6YIEPHFMnY7nG4qLP4IkeNNZ2G9a08u9A/p+Gh+Qy4QYiax9GOvFkFIoY6E1tV:r6bEPlgY7fqLIg2saLu9A/vYQIYXxE4H
TLSH
T12F3633E9750F322F3057F3519A26A0D7D688BBF78065E116C585F56B8B648B13CA03E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up010.msi
- Size 5.1MB
- SHA256 81141682ee3f9a90a5a76de1c86e3326adf5f323ca383b4b274729689a72001e
- MD5 3c4db2e78f0647381cc6fe4aa7f2fa10
- SHA1 fae4a3645580068c7ae9582c4b7aebdbee81101b
- SHA512 4b8a5af1d6920f944ca26b9a0ef4ac4f32bc6d8023e13c7d55db641d6fdb73c862fddd9458707674462f845191906a9a16b0ff95c10070435fd710a53e67a0c0
- SSDEEP 98304:Ov2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9dYRTuNwqC601k:g2nuF8NCeEI69grA1YyYpFvaKNCdXq+k
- TLSH
  T1814633957C8A2738D087D3B0031231AEB1197FC6BE339C17BAD976198E72A2664753C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2