08a186c3508794b29a7d3b134260500f4e14008a97ccd613a652d308dd618683

General

Target
08a186c3508794b29a7d3b134260500f4e14008a97ccd613a652d308dd618683
Size 7.6MB
Sample260721-wlxevasbpb
SHA256 08a186c3508794b29a7d3b134260500f4e14008a97ccd613a652d308dd618683
MD5 4864991c07a3b8161d6833a1e3976ce2
SHA1 3d9e93ac35c50baa52bede9587c9a352fbfa8ca6
SHA512 3374e4a465384dac605902172b3099854026c648918ec3f42171010355f9292973573bde42f77b015940aba166c555064641c64cb15b408389d48b515ae20f69
SSDEEP 196608:GDum6R7swWkJIVQXoGNyeURNamVPabJApU:nDgAIuXoGUxTLVPaOpU
TLSH
T147863318D86D7A2226B09147879E8D7B366EF0CA7158F67C2372CFB18D18528FF16E14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appstup.38680020.msi
- Size 7.8MB
- SHA256 3fce70571e4b970448f3992f11dabae0832a04a870f8c0ecd48140b32e081aec
- MD5 924f71f380adc0f8ac84d1e5e7fb2dad
- SHA1 9c8eba1040610b19766308ee8e36a3819213c06c
- SHA512 9f49c09bb4351cdfcfd8f222f884c00f3a6a5032d707ef5b81d85658f5bed40e30a538e4d5604b2d8383ac90135e46e6e11c2b82076f1f621eb6f48768d1b192
- SSDEEP 196608:bPArDQiyQBkao0+nSfQDNRJhyEAL9yoJ9gZleR4:sEUxCSYDG7hBJ9g2R4
- TLSH
  T15E8633A0B8C92770D097C3728243753E712D7FC5BE36DD2A36E9BA145D31A29E9B1708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2