1031c5849b71fcf1048e6057a4ffb2d1c408797323ecec5922dca1b987f39d97

General

Target
1031c5849b71fcf1048e6057a4ffb2d1c408797323ecec5922dca1b987f39d97
Size 6.1MB
Sample260804-y5rd2sgd92
SHA256 1031c5849b71fcf1048e6057a4ffb2d1c408797323ecec5922dca1b987f39d97
MD5 ebbf12f1ae068dd656f63577fc6f5fa3
SHA1 133215a631e7a6ff19a9eec6e5dea90d52dc72ec
SHA512 b50a4483e7a2b1808cf47f6c54f172cbe6ac8d1457b27a73e29c384d4fdd590362f46673678266251867b846f9fae867e851ae0f8e7b3426df4017a7688bbb84
SSDEEP 196608:p2WHrzGHZ2o1Z4RSnDqv5bAxkH9+/3YrDWsxsyH:p2Wc2oz4RSn+vZA6U/3sxsO
TLSH
T1BC5633C9C8CC4B49B3D475C6E97D276B6333FA4D1C814B45D9803A7AEAB8E5078A423D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  inst_s0t011.msi
- Size 6.2MB
- SHA256 e004305ed7dbf7c8edcd03c111f45bc9c7733e400768ec31da7708eb63a4bfb9
- MD5 341de8100961dcbbbd4bfeaf8bcfd315
- SHA1 8fe5edcada8f636860d3921e9d7ac3e37b357344
- SHA512 7a07941b6287466a7059b59817b6d054375d298177ced812735584b1e399899a3c55018b1fb9d76defd3a479925a0e3d295693df549118ba204cf4a4be673687
- SSDEEP 98304:ba3nM4/QH8dggU5NSj1Cj2kU0KGn1rkdXXaIUyFBNCNxbM0L6+x4DjHYT3pPCNyr:bUMWzWR52O2beiEHynQ1x4DbY7pq4JmM
- TLSH
  T1DC663395BCCA2774F057D7F08556323E722A7FC91F228D0A7AD8361C5E72A226CB1358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2