246bb2937cc5ec07dcb01982900bdfd20ea84ff6a8340b40962deee4997a1531

General

Target
246bb2937cc5ec07dcb01982900bdfd20ea84ff6a8340b40962deee4997a1531
Size 9.1MB
Sample260802-lv39msxvbw
SHA256 246bb2937cc5ec07dcb01982900bdfd20ea84ff6a8340b40962deee4997a1531
MD5 c838b5ae90c00915040d57b3938e7b5e
SHA1 0fcca596e5e87113d54ba01340228263349a26f8
SHA512 e24d2955f6ee1d45406035dd8163ed4dc52715677ca9526425c0153ab881ed255a8c76e99942c3097e7588fde67b39f05a771f419a40ab3a5611f245bb2ff35a
SSDEEP 196608:knD5SQiSyx7dYFLJj9fVNRfjN2E4MWrvQQPSnCfKVzwkM:kFaSy9dOdJRfjNyMWrNKnCfGM
TLSH
T1A6A633B79CA865C695BE1C8407BFC9021ADCC99C729DFE382E764DFDB0901929CD64E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up013.msi
- Size 9.3MB
- SHA256 8a971ba6ec179f2ced4b3fab5fc0f7011ff1dafbb01c28182f75b7acb7e895e7
- MD5 ccde2cc508abbe8b64abfcbbffd97eef
- SHA1 87eff178a39cbe923969b2a4a0cdf9b8eaf6dd7f
- SHA512 ea7a57cd4176df00bac7367745dae63f1a48b8a4d0d6fa3a05270020598c6789393d846c902938f4b58e6f0d00a85534e9a1fc158af41b12d4b8d4d73c6e0868
- SSDEEP 196608:wEeESomE66Drt8bZRZPVNxXpfbX8EmUqXBiY5cHS/CPz4sK:9Se66PtknZNlfbXqUqXfCHS/2K
- TLSH
  T1BCA633C7BCC437B1C1ABCBB04127B93E3A9C7FC577669C193BA93A64293132552B5284
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2