f3bf529825fbde42fc0d6d8f58809b7265761e8a87260d99e7c334dc3519fba2

General

Target
f3bf529825fbde42fc0d6d8f58809b7265761e8a87260d99e7c334dc3519fba2
Size 5.1MB
Sample260802-jjnnpseq31
SHA256 f3bf529825fbde42fc0d6d8f58809b7265761e8a87260d99e7c334dc3519fba2
MD5 7863d3a49eab9408409837387579ecc5
SHA1 c698eb56ce6fed0df7ffcb5facaeeb0b3a42aaf3
SHA512 51c17b8ae46609f769e4ec538f1d8b5e42049b24be41f2749ed0f18af4b75e425caff2b9c17b2ac2fed83c0fe35be0ab19900a847009c5c2b1417dd3de18594e
SSDEEP 98304:CYtfP2pwMDfYOKyf5JWqdbg6qgkBkBr4nt+NeK5BoF4j+spCfRvhLnlzfR3Qm:ztfP2pwMDfuy5JXJB4t+rBoF4jOfjLR1
TLSH
T1914633C7B188228D450EAE0DEC0B61C961C7662A52ACD3FAE38F454BF43965CD7C6678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up012.msi
- Size 5.3MB
- SHA256 9a261aea6b6466c0d5c514925ce49f339d8612a6fd51969b1aff2a44de2a3dc5
- MD5 a833818b0d650f1c90e36ea8bfdf3fda
- SHA1 bccabe61e2c3933181bc137f17e9f2e8bb80eea9
- SHA512 e01128843a3c028c62ea0fff3c26b823c0905f95940b46d17492c0210ce19c4a4ef7f7c2ab440985371d4cddb06099a8da67012017b67492f3df470b1f86b850
- SSDEEP 98304:aVK8PysWY6KKv51IQ/bw6+wov6LDo1gz+CPxi5MZ9x//5jLprpfP3up:atP2Ao5159L8gvmy//lLnP3k
- TLSH
  T1FD4633CA74C83738C08BC7B6454365AD762A3FC5BB768D0AB79D3A016D7272902F6385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2