1ed0c9d174b5b4c18ea4649635a4187f6013a8164e1241971e75f4da724401d9

General

Target
1ed0c9d174b5b4c18ea4649635a4187f6013a8164e1241971e75f4da724401d9
Size 7.0MB
Sample260719-q2lemab19q
SHA256 1ed0c9d174b5b4c18ea4649635a4187f6013a8164e1241971e75f4da724401d9
MD5 7a8fea75edd035f4a1c24880b8fe7707
SHA1 7f88a2d692f6667802d081899a276419fc5f0197
SHA512 f127f6b420778ecdfd6a037764777277003cd200b06319643a64dc2448327bb255cfaf14453b0570bb89438433945f1fcee308f6002b0613701e8e10feebcf49
SSDEEP 196608:hot0DHXmWtwdzA+Q2r9iXjA4W713Ltz1KqgV:xD2PzygiORbZo/V
TLSH
T1DF763364072B5DBE4B4D74B535B5411A4013BE9AB6A7FBDCB9C8831BE03E0F8788161E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  installer.83325tt019.msi
- Size 7.2MB
- SHA256 8e5f2f56991321bec2146d514b0e7149deb9f230979aa02d3066e73c63a7c71b
- MD5 f05ae762ca21430a9b0606b7b7db7b87
- SHA1 2e67061475f473d058a133d71d019369d99cec2e
- SHA512 1fb2e60b72ef654da0bb38e2a3ac383a60afa96b97df79af7f20d0afe8e7d7165f901420ac07a124628dd2291f13ac1de3676316ff1a726cc56c77153a20e2bf
- SSDEEP 196608:rI4QLlTm6xyJZ3xJefSIbrsGKTb3BlRngOi:rqxy3Z3xJRIMnxPg9
- TLSH
  T11A7633D169863779C24BC7B161A3192E38267FCABF778D4A76A877016D32220367370D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2