c721d0b9e73fb94ff72efc54a8e10f3ef159209032c0d562ec0a1a684da1526b

General

Target
c721d0b9e73fb94ff72efc54a8e10f3ef159209032c0d562ec0a1a684da1526b
Size 7.5MB
Sample260802-tqgh3sce52
SHA256 c721d0b9e73fb94ff72efc54a8e10f3ef159209032c0d562ec0a1a684da1526b
MD5 d0f2374bb0cc7bf0257dfbb13d853baf
SHA1 f50b6490b71d31204077f842fd0853da89e99c00
SHA512 d0c6487a62e104d67cf6916f0637d9f5319d2399ac19207552983a10c6c3270a77485a2b693124f1de1e96bf9a88309a549015761a260c8a73014a3dbbb95441
SSDEEP 196608:fkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOY:f+eAAUDCYlMKqPzvO2On
TLSH
T1F7863383AF5F2181DC383D827E2CAE358E9F75D24B6529262846BBDD9D044D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 a97a33f86b7bf220e6d05e6c254e2ff361d3ac78d3baef2866f88b95e42fa910
- MD5 8dc2349b78116db607777f891a7742bd
- SHA1 a4ecc4fcf7be60530be469e08283342a25359a19
- SHA512 cd3d5dd6612d1fd5cbc263ebe8cdf5e5635c988a39dbe388b10c45738f3f1bed7a885d1a8369dd6f4f830204a89c6bfed9553ef9d994455ee6cfe2d56a94c537
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gD:IA8oKhVeLwUSPVjqSwO
- TLSH
  T1868633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2