634a5a5d107417f26dc3d7150c3cdf2fa754e1567d89fafed047bdc5af3d0cac

General

Target
634a5a5d107417f26dc3d7150c3cdf2fa754e1567d89fafed047bdc5af3d0cac
Size 5.0MB
Sample260802-hvvqqaxbme
SHA256 634a5a5d107417f26dc3d7150c3cdf2fa754e1567d89fafed047bdc5af3d0cac
MD5 97b90ca42d99906f814eee3b8fb57c12
SHA1 4d8116edc2ac245bc1c80bdab6a9cc80bc2aa636
SHA512 2689c1b475137268098d395ee19ef1ce75f03e00caaa708cee81d8e7fad5b3e9bbbfcf3e6a5372bcaceccac26585d5027ba8f1b264de31b4ff830e995427af37
SSDEEP 98304:1Q6YIEPHFMnY7nG4qLP4IkeNNZ2G9a08u9A/p+Gh+Qy4QYiax9GOvFkFIoY6E1tI:C6bEPlgY7fqLIg2saLu9A/vYQIYXxE4e
TLSH
T15A3633E9750F322F3057F3919A26A0D7D688BBF78065E116C585F56B8B648B13CA03E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up010.msi
- Size 5.1MB
- SHA256 52b76f1eb6e09ff248195e53d009e1039e6851a4d5b2f9117d61fbe736e00a1c
- MD5 813cda439a87d01133aeb95968bdaf6d
- SHA1 af85e4f7950002fa1674e84b429c117f4b0f3a74
- SHA512 7312e39cccf41fd859445597fac14c252f65d8b5e001f6d2eb1c04c0b21c38c7cd36c2fa034bc7a0577c01bbed2fb14a71ab07a47d508239f2a6af3cdd2a778d
- SSDEEP 98304:Ov2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9dYRTuNwqC601E:g2nuF8NCeEI69grA1YyYpFvaKNCdXq+E
- TLSH
  T10A4633957C8A2738D087D3B0031231AEB1197FC6BE339C17BAD976198E72A2664753C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2