816f8dd93d40d6cc1fa682c65b5b6baeeb4a34720aa5508cbfb676320f31c51a

General

Target
816f8dd93d40d6cc1fa682c65b5b6baeeb4a34720aa5508cbfb676320f31c51a
Size 7.8MB
Sample260802-mx4hvs1dqd
SHA256 816f8dd93d40d6cc1fa682c65b5b6baeeb4a34720aa5508cbfb676320f31c51a
MD5 0c064a6e5d8eed86cb8985f4fdf4d63c
SHA1 a6ba7ca3ca9e91696c68347a1f476515f690a458
SHA512 308b8d418192ce83949bf7d8b9043420b07cd1292cfb6e834ee3664b77a29e4dfc88bb889cc1f8acb87490946685967712f0e50de7a09312168f7a8a9471f5f6
SSDEEP 196608:mfBNce0SgVentiGoIbv7AeA4tZmGGPxl8+cDiuGGcWYCXC1:a+VetiUPAUqoi1
TLSH
T1B88633FFEF14406C79C273CB20639A6E48A016489635104BDF69149AFCBE36662DFC97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up014.msi
- Size 8.0MB
- SHA256 2a27e7f3109a2394fa572ce265ecf9d0ef1187973d864ac82454027970633af2
- MD5 2a2b50299a729e8ad31725a3517965b2
- SHA1 532896cc38202f3766e0834d78b6a59eb740b236
- SHA512 285a85f391cb4842875f405312b447c867466f0ef1eb2f1173660bb9e3996a7300c6cd92588d30cc7d54f5e085f2b6c70a1be977110e7756aec50aa001a528bf
- SSDEEP 196608:mgehuiSk6jqBt5Rbgn713RsAiI3Z4wMH5zQAO5iUO+oqYCdg5:mGjqDobiYeyG5
- TLSH
  T1E38633DAFD8956B4E083D3F20023662EB1A47FD5BE364807BBED3A047D7622214B7645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2