3b734d593a4c747dd33df6d5f089b596d249d6b0a0b07a51891eeb65427aa468

General

Target
3b734d593a4c747dd33df6d5f089b596d249d6b0a0b07a51891eeb65427aa468
Size 9.0MB
Sample260802-sebb9avhmg
SHA256 3b734d593a4c747dd33df6d5f089b596d249d6b0a0b07a51891eeb65427aa468
MD5 81167a2a7f0300a6646c93e56f1d4c47
SHA1 f0364f9ca51a15eb789863564148caef91c66ebf
SHA512 f0cc91d3cde197ae6c5e8cea7844c68c54b6b555964e8fbc6faf5eda7bac2b4dd697c6ed0761f834b56ed836fedcf7098f98f837ab556ad7d9c062e077c6eae8
SSDEEP 196608:TBKTA+L4ogFb2BP5dXNBvGgfEskoLBD6rMGDzUtbS8PWzDM:1KRgFKBBtN9GgcskmBDWMUUwUWzDM
TLSH
T1E09633A14ED701F045918E76ECDFE250076123F641A3FC946E99EFB518DFA1BC4AEA08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0sp005.msi
- Size 9.1MB
- SHA256 16cd28346d3592ae926d87d2bebb88a39ae31b0872488c4ed533ec26d5545fee
- MD5 6ad75098eb1b029b59d4ff5a3f29aec9
- SHA1 354e74f344fd7dd1a305538447e2fd4d33868898
- SHA512 26750ad57189e5c9c0096e3149533788470a2e93a0da402812090ca6f728d1e5184e6cf78e042c7e74b9ae28b7b9a05bbe456c4ecf2635f7f2b99951bc00e579
- SSDEEP 196608:p1vFonaAghFK10txfW4ZmGkiZph4rmk5hKTbZPId3G:p1vFo7ghcStFW4oGkophgm0KxId3G
- TLSH
  T1CCA633C1BDCA27B0C193CB709496616D7E243FD6B9779C057EC8BA101DF2B2A957A308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2