207b024f8bcbe427164f7ee7ee0406b8910c8bfe8e7002806ef2cae34bdf3b54

General

Target
207b024f8bcbe427164f7ee7ee0406b8910c8bfe8e7002806ef2cae34bdf3b54
Size 5.0MB
Sample260802-hd4bjaem5z
SHA256 207b024f8bcbe427164f7ee7ee0406b8910c8bfe8e7002806ef2cae34bdf3b54
MD5 c8d75cbfdc492500a728726ebbe55919
SHA1 bba796139995946b92a996098303bd00d4173bb1
SHA512 fcef7581593f6df7a295aaa0b704aafdbac4099fc64effd18e8e419a78913a10136bbcb99de601a809f988fb58f05586e6e05de4cb552143907758cca6a6ccf9
SSDEEP 98304:3Q6YIEPHFMnY7nG4qLP4IkeNNZ2G9a08u9A/p+Gh+Qy4QYiax9GOvFkFIoY6E1tc:g6bEPlgY7fqLIg2saLu9A/vYQIYXxE4W
TLSH
T1193633E9750F322F3057F3919A27A0D7D688BAF78065E116C585F46B9B648B13CA03E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up010.msi
- Size 5.1MB
- SHA256 cec62981dd53662d65a3dc11e790d49d927c37a201a7573798e7e372a0cf7e0b
- MD5 b137953d85adbb1f6fa892100eac6bf6
- SHA1 fb3a843bab78d616623c189530c3e387aa111b22
- SHA512 77ebcf3de96ed3496cf985a25112e4a5c66f1c63808d13f0e05a91d269ec4798d3678e2eeb34a4cdab7e4585d06d0e03bbd9ea8b640ada4161714fa796207506
- SSDEEP 98304:Ov2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9dYRTuNwqC6018:g2nuF8NCeEI69grA1YyYpFvaKNCdXq+8
- TLSH
  T1824633957C8A2738D087D3B0031231AEB1197FC6BE339C17BAD976198E72A2664753C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2