1c0ae948d9d57954001fb15fe6dd522fa00f17528b12ca0072d5af8ed52eb299

General

Target
1c0ae948d9d57954001fb15fe6dd522fa00f17528b12ca0072d5af8ed52eb299
Size 7.5MB
Sample260802-n85ezayzcs
SHA256 1c0ae948d9d57954001fb15fe6dd522fa00f17528b12ca0072d5af8ed52eb299
MD5 31aa4e200b47638d124f4984a91d91a7
SHA1 0a3fa5a6dcaf9c6b11a982ab4bea47aed881f499
SHA512 14a717769f24aa75243531f8ff17ab5c42dd31b102bcf9446b83e04664663ccaf69c768afdef31fbe8598c22d46b9fb9c395c2b7e0bb82bb73a54c323eff5dcf
SSDEEP 196608:UfvcSGEmC8WOmM1YyhpHiTNHPS6eBymR0QxmQHb2j6Dds/xioCr:zCsmMuLTNHHeBPuJWb2j6pIq
TLSH
T15276336BB4E467E38BC445E03CBB5B07D88936EC613E93A2FFEB7076054D46688C2654
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up021.msi
- Size 7.6MB
- SHA256 e6f23ccde9b052c3c9fff6a4d75acf6a1b0c9aef2f3d9947f0f46d3dcc200e9a
- MD5 a106ed05486b840bfa3e1284ec2700d7
- SHA1 f903d5ff83590e394f440dbdec1e1400b8543005
- SHA512 5ffbdee1801ddaccad6ffa1f618562efad38c73fe0ae80aee5897fa5a11ceb6bbff0c8a9279f99e7bbad7742ac583fe39ec0f1b4626b84c0d0bc6d1d79d213d4
- SSDEEP 196608:jM4MdoSAEWekWmmyn0ZO6M2RQyGFUEzckxmgd1gdIDpqXP8i0/:jVeAmyIjCyGFBQbS1gdIN+A
- TLSH
  T1E586339678C57BB1C087C3B064A7765EB0293FD47E654D23BBEA39280E7652A94F3340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2