a78aba6f09111de6b35a227cdea9d3cf90dd0e4cd657d6942f2fa65ad16f261c

General

Target
a78aba6f09111de6b35a227cdea9d3cf90dd0e4cd657d6942f2fa65ad16f261c
Size 5.1MB
Sample260802-jhl4gseq3x
SHA256 a78aba6f09111de6b35a227cdea9d3cf90dd0e4cd657d6942f2fa65ad16f261c
MD5 1dcb9cfef388277eecc16479dbcdb63a
SHA1 43e78886466affdcc68600cdb0b6f962be2c6faa
SHA512 a3b72131a33edc724070c746623700a20e7717ae04cdc7d34dc4281201d94f499a7a8a4ba8c36198b850010debb05d14a6524200ffecd0a6c4da1b78fa080511
SSDEEP 98304:jYtfP2pwMDfYOKyf5JWqdbg6qgkBkBr4nt+NeK5BoF4j+spCfRvhLnlzfR3Q4:0tfP2pwMDfuy5JXJB4t+rBoF4jOfjLRX
TLSH
T11F4633C7B188228D450EAE0DEC0B61C961C7662A52ACD3FAE38F454BF43965CD7C6678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up012.msi
- Size 5.3MB
- SHA256 a00776292d3c33102471bd3296f7b2d05ac9066a862f29b81b31e2da61cf80e3
- MD5 9e40f4439ae27c7395b1eb8452d0c2bc
- SHA1 7167774f3375ec59a1d83f616db3f5f832cf0a83
- SHA512 dd32de61dc3342b95a61d70f8299b4b820b5b0f0cb06a23e8b6a989b689e120efd18efb503e62e655a2e3974761260cbb3ce17eea4040f4300539b11ef2ccb0c
- SSDEEP 98304:aVK8PysWY6KKv51IQ/bw6+wov6LDo1gz+CPxi5MZ9x//5jLprpfP3uD:atP2Ao5159L8gvmy//lLnP3O
- TLSH
  T1A24633CA74C83738C08BC7B6454365AD762A3FC5BB768D0AB79D3A016D7272902F6385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2