23e3552d0b2192c139387952691f5e29e8b0930871a3d5c7520f12965b08b10f

General

Target
23e3552d0b2192c139387952691f5e29e8b0930871a3d5c7520f12965b08b10f
Size 5.0MB
Sample260802-hdvdmawhpb
SHA256 23e3552d0b2192c139387952691f5e29e8b0930871a3d5c7520f12965b08b10f
MD5 6fdc8d1c6178e4d527ea82ffea99d65a
SHA1 e83c9c51b93e43fdba6f12674b27fd50f775ac3f
SHA512 8fa59970e66aaf696130fc1a8fe1db3563a0608dc8a9464b4f6e788f639e56f9dec79063eea5d346f3f93cde252007bcc6debb1e1bf2ac8d0be34e0250dec6ae
SSDEEP 98304:JQ6YIEPHFMnY7nG4qLP4IkeNNZ2G9a08u9A/p+Gh+Qy4QYiax9GOvFkFIoY6E1tH:+6bEPlgY7fqLIg2saLu9A/vYQIYXxE49
TLSH
T1CA3633E9750F322F3057F3519A26A0DBD688BBF78065E116C585F56B8B648B13CA03E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up010.msi
- Size 5.1MB
- SHA256 c22d0f23a38851f21bf67c132d3872bb19f3e6c6fb730feac16ad496e9c1f943
- MD5 5116c5e7044e83cd4f0b96140cd05551
- SHA1 75bbdcfdb6ba230c1c5d2bf79485be49810a27b6
- SHA512 e59404b290f9c185936de6f817a567ac13b5dd94204f42f96eef89871eca321a2b07a4959899699227057b4322c0de4620df57a65f31a339bc44df2840b95e1d
- SSDEEP 98304:Ov2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9dYRTuNwqC6015:g2nuF8NCeEI69grA1YyYpFvaKNCdXq+5
- TLSH
  T1E54633957C8A2738D087D3B0031231AEB1197FC6BE339C17BAD976198E72A2664753C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware discovery exploit trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2