e678bf2d945250b116694d978bced4633f9b3714a65f03814cddd2fc2a0fac57

General

Target
e678bf2d945250b116694d978bced4633f9b3714a65f03814cddd2fc2a0fac57
Size 5.1MB
Sample260802-jlkptseq6s
SHA256 e678bf2d945250b116694d978bced4633f9b3714a65f03814cddd2fc2a0fac57
MD5 f943c0a700ed962c1c7734d7118c5615
SHA1 c2394c81715aef3b2fba3337d0b17e190d68fab7
SHA512 b03c82203c19f1b85b01be4200cf390f0747c0818b9e93fe1a73daccc92b2624311978c0087fc2645a7e10b1f86a00f42a46e9224c01fae24a8eeecf441488c9
SSDEEP 98304:PYtfP2pwMDfYOKyf5JWqdbg6qgkBkBr4nt+NeK5BoF4j+spCfRvhLnlzfR3Q7:gtfP2pwMDfuy5JXJB4t+rBoF4jOfjLR+
TLSH
T1124633C7B188228D450EEF0DAC0B61C961C7662A529CD3FBE38F454BF42965CD7C6678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up012.msi
- Size 5.3MB
- SHA256 95ad23c6d8da03ae2c60c58cc2c710b96fc1f69b59e11fd3dc97d760a66319da
- MD5 498e1a4c6319869bdfa4d8243d52106b
- SHA1 3934c9eca32e6f5b1f0ff97c572ee9b7903ea5d3
- SHA512 acc75b0a732978126a18d126e7de5311a94f7736f08da6b6a9cb9d413e0f2c6dbb88831521895d15bb04f73fdef20c6224122d9dd7a52deb25aac408a281d69c
- SSDEEP 98304:aVK8PysWY6KKv51IQ/bw6+wov6LDo1gz+CPxi5MZ9x//5jLprpfP3uL:atP2Ao5159L8gvmy//lLnP3G
- TLSH
  T1384633CA74C83738C08BC7B6454365AD762A3FC5BB768D0AB79D3A016D7272902F6385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2