4884505d3979a00d9a65b147e6746a0fab6e4f591d34443fd73de5ea88737415

General

Target
setup_n0c009.zip
Size 6.9MB
Sample260804-m7dp7aaa66
SHA256 4884505d3979a00d9a65b147e6746a0fab6e4f591d34443fd73de5ea88737415
MD5 0e022015148a297c30134f3406eeae28
SHA1 a25504c462ece4d3a52c48398d9f6e915133625f
SHA512 a0aa712f51babef77bbc4ab6be4e6cf2cfdf27c548ba152cd710c02a3ce87277e54e3649cfca9343d8f6bb7fd6443db03cc88e6d32d80f72297f7016e4ca6536
SSDEEP 196608:NEL6qipXt7yPHUipI/Qm2s35K4xdKBLDnLzjM33WGj:ii92fUF/Qm2spK4xdaDYnWY
TLSH
T11576330201997BB7475A06AA2FB39704C5013D49F801A5A9C8EBBB4593F3B9F1DC39F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c009.msi
- Size 7.1MB
- SHA256 0f805f23901f431066e2b0e7ba9fc39db05187dbbbb35cf752934473dd5830fc
- MD5 87a04434587710453e0e936b78a5baf6
- SHA1 82c3a8c054fc40e0d13829c54b29081bafd8af4e
- SHA512 7097b2185408040b8a8f2eb6b88dfac17a7f141de3a76c35fd0dbc34ee4949129c59d0f03844f3d8fecd33eb6775f92c9abdf68044dcc7bb989df85c6f4c740f
- SSDEEP 196608:QUTss0UBxNzE3NUsTsJtR4Jy4QrZ2Y9DCztRZvpNeX3Uah:QUTAg7gdUV2Jy4Qt2Y9DuP6HU0
- TLSH
  T17E76338669C47772C09FC7751A53626CB0293FC6FE624C07B9EAB6004AF372A54F2785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- SilverFox-style Panasonic/Sauron loader chain targeting the staged Panasonic wrapper, image-named Al
  SilverFox-style Panasonic/Sauron loader chain with staged loader, Alibaba OSS carrier grammar, side-loaded UxEnhance64.dll, RPC Task Scheduler payload, adoresd bridge, and Sauron Edge stage.
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2