550b5145fed14b156ddeddaa6ecf6bfe89b92353b1179b29c953e9fc09adf549

General

Target
550b5145fed14b156ddeddaa6ecf6bfe89b92353b1179b29c953e9fc09adf549
Size 8.6MB
Sample260804-gdv5gsgp3t
SHA256 550b5145fed14b156ddeddaa6ecf6bfe89b92353b1179b29c953e9fc09adf549
MD5 991ce98f9cde1c6ba77b41c82779f960
SHA1 57230987fa94a32457fb08b0ee27a96b093e0e70
SHA512 35d1e9ca1e78dd3ff61d947f73052e740225bb94fa6870dcf115c899638245ed13404762dd5a6fe7d12be7d4531792acac4588382c11a366f23b75b523be7a97
SSDEEP 196608:36VxcA6sOHgSNMePXgo26jn2Ne3asjW2LOt9MnrGZpDDoCT4Ma/fsFE2:36PcAYHlgf6ye82LOtUGfsjsFE2
TLSH
T11396337863BFC8094EEFB99948288A8E8579E45A05DFF73574C7700C6301BDAAB60753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c015.msi
- Size 8.8MB
- SHA256 17f30e667f29d5c6ec219e42c5742f63bcecafeae2e67dbe0b040eb912231ec7
- MD5 c96ad57a7a5a892087eca29a1d861cdb
- SHA1 f85d66fe8af28674d4f048a5c57d87344d8616c0
- SHA512 50e22160300b09717da28bec370137cfe5fb0b3d7cc103e2cab3b7a3b76cbd46207b5abc3f89e4dd464c213bd8e162ca2ec364d290768c825a7b8526a95fef41
- SSDEEP 196608:YbOyhL0UYsIHEkq6cxk5z2OmKz+tubKAhI2Lyb9A1fE5/xNueT4iqHXYFIT:jyB0UQHvdQuA2LybYEJMhYFIT
- TLSH
  T1429633983ADFAB34C5CBD3B44401A95EBC2D7FC9396B9D0674DA39042B32A1B9331356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2