e16cadf4c47d1f2c4dd98c9898295bb34a54ed97493834089a9dff7caaf3b05c

General

Target
e16cadf4c47d1f2c4dd98c9898295bb34a54ed97493834089a9dff7caaf3b05c
Size 8.4MB
Sample260802-kvdtbazale
SHA256 e16cadf4c47d1f2c4dd98c9898295bb34a54ed97493834089a9dff7caaf3b05c
MD5 0be4f8a046a943a2f7fef099696ed075
SHA1 4f31e45f0ca72dcfe83fb286acb97438dc60aef3
SHA512 2a25ee47ec01a1ab39360beabdc7dacc4061863154b244f481c90e639b0623017f2b548fee1df3881b9a9cb5468161137904fddaf6bda92149d9c54145304a69
SSDEEP 196608:Eh+6u1PIqEO9ZUJObXws6tN4XuF/qQwKJesUxiqub2A7r437xbU9/2:Eha17EO9ZUUx6tN4XuFiQwn8VP437xwu
TLSH
T15A96338BB9D081BA3551FA459C349B06381035A7AF950DCAFF6450EAFCA879A3C473D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up007.msi
- Size 8.6MB
- SHA256 4b8b0e853949fdfa7c14035621163ebe2d35b8043448019a03b468ffa43a49a8
- MD5 846bd31b3a5cc4a956e3cc9dda213fc8
- SHA1 cb3f002b0e53a8685222954857ff5475abb40f26
- SHA512 2debcaf0e39418e0f0eeaac224743c870a2791d42b849ac6d7ec5fe00b2d6f1473b4afe253b4bc40392bff44aa47dd2ee8de053b1d7e05136e3ea581d08d04cd
- SSDEEP 196608:W6WTYIpbo0g4lvOuUdZpEXmPNkCM4X+I4Hmq+r0ARtMhnYJE/JDH:fwp/g4lvOuUdZpEXmPmCMTGVbMhnYk5H
- TLSH
  T1DD9633C67CC52374D097C7B09823A62D39253FD4BF664C8ABFA87601AC717262977386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2