cf26610670ad5ddadebcc419b081095a6bec85db841a02f8de6a00025fa09239

General

Target
cf26610670ad5ddadebcc419b081095a6bec85db841a02f8de6a00025fa09239
Size 7.3MB
Sample260802-mbbkysgn2x
SHA256 cf26610670ad5ddadebcc419b081095a6bec85db841a02f8de6a00025fa09239
MD5 445d8eccd874dd12be91de2c6a19435b
SHA1 0f6a58ee5a784d7ea275e86f0155de9d5ef08f0f
SHA512 0e1b8fdad74aa03c0835ac2a17fd1d1d363c7d88d29411b2349ed72fa7118c2c66ccb77126f946496938aa84e60e16497a79fcd8ece782ed51d2f2de03944ce6
SSDEEP 196608:ctm47QmBAikBHmz3AAC4zqsYb8+ji92ryweeqCZ:riQmBQmzwAZYI+I2rC1CZ
TLSH
T1837633A4F1212DFEF3C70D3C29FC25A55E5EF6E5A124724AAB8F285F439949781A8031
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up017.msi
- Size 7.5MB
- SHA256 bfe733457b83f73a4958b95a92f725b45870f82e94bcd389627469432b2caa93
- MD5 0df8f9a1d3d13632ad04577f62d7af43
- SHA1 11feed19afef2f07e53a1f32b17472dec3210fdb
- SHA512 eb25950ac625e65055e6c068e0503ce9f8b0e2a097cb1db6b69c6280ca93ef8a754bb3fccf0980154050e0751769cff4b92f953ed129d1b5dc83df118c7c8fa8
- SSDEEP 196608:wCSNa6LGYIbHer+PusmZqP6k3U7CFsiq6mEI:PQa6LgeaPusyqyEWCFiBEI
- TLSH
  T14B7633C5B8562774D08BC734155A21AD722EBFC1DA38ED0BBFED3A0C1EB263654B5260
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2