c61f5ab5c7728ee5cc41ea297974fb86c5597b315e64ee6e1799224b8829f032

General

Target
c61f5ab5c7728ee5cc41ea297974fb86c5597b315e64ee6e1799224b8829f032
Size 5.1MB
Sample260802-jmlnhsxfmb
SHA256 c61f5ab5c7728ee5cc41ea297974fb86c5597b315e64ee6e1799224b8829f032
MD5 303169521359cdf025e25d260df124bc
SHA1 f09bbe4cc5ddbea749c3a29f8122919fddef24b4
SHA512 e7e9ed7a937a19d7fa029c718d3197b4c6d7bdd2a3f1f8a0de9e692dab835c4c0442dc4006e20abc3a084b4d35474e9635801c755b07e562ec118fba15687b74
SSDEEP 98304:eYtfP2pwMDfYOKyf5JWqdbg6qgkBkBr4nt+NeK5BoF4j+spCfRvhLnlzfR3Qm:vtfP2pwMDfuy5JXJB4t+rBoF4jOfjLRp
TLSH
T1734633C7B188228D450EAE0DEC0B61C961C7662A52ACD3FAE38F454BF43965CD7C6678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up012.msi
- Size 5.3MB
- SHA256 4e19d1e4270807be4f0d9ce5b58941b79f47d5eb288db6a9b180041a41714c69
- MD5 d8dd92da7787e6c5a5432ac2fe99b42c
- SHA1 ad9dcf7b6ef5b1de1968a2801db9787421ede1b5
- SHA512 7563747af4b8b3d6906390fa6992c4f6d311a97aaeb4a1c552a28ebff17313de118ef23ac2cac3f7b9a0efce40b0ccae1811158bee5f467d09e2d7b9f949c070
- SSDEEP 98304:aVK8PysWY6KKv51IQ/bw6+wov6LDo1gz+CPxi5MZ9x//5jLprpfP3uD:atP2Ao5159L8gvmy//lLnP3O
- TLSH
  T1944633CA74C83738C08BC7B6454365AD762A3FC5BB768D0AB79D3A016D7272902F6385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2