dd6f61610148e3d0a211c6ecff5bb5ce4838a59cd12aa96faf1a76ca2f6cea6d

General

Target
dd6f61610148e3d0a211c6ecff5bb5ce4838a59cd12aa96faf1a76ca2f6cea6d
Size 7.6MB
Sample260721-ws7jdsde97
SHA256 dd6f61610148e3d0a211c6ecff5bb5ce4838a59cd12aa96faf1a76ca2f6cea6d
MD5 c15dacd5f9393013d4f2bfedca9aa143
SHA1 5765453227077f42985f4f7cd821cacf1de6bf8a
SHA512 0ddeb2f89bc94b077594a2defbadfb3c95ac2810ba45743cb7aa9cf53c118b517aa89afcebea4ae2c0be5faadbf0176824a65e94806918b1cb3afd10f3812915
SSDEEP 196608:WDum6R7swWkJIVQXoGNyeURNamVPabJAp0:3DgAIuXoGUxTLVPaOp0
TLSH
T14E863318D86D6A2226B0914787DE8D7B366EF0CA7158F67C2372CFB18D18528FF16E14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appstup.38680020.msi
- Size 7.8MB
- SHA256 b07a0d7882a183cc6bc1bedf91e53ecd77041ac80c6bab340ca4ce104fdd9149
- MD5 9d7211fe1092a176e78dafaf86dd6197
- SHA1 38babfe0af33596d3b60bcd2ac553cf606a4476b
- SHA512 5415916812d497b7fc214b1bde88e199c7b9ec81153a9ec33d399711b08964a17fea2a7102d5546704165d97c3fb10e118542302ca44b7da1be1f0f692c0ed97
- SSDEEP 196608:bPArDQiyQBkao0+nSfQDNRJhyEAL9yoJ9gZleRP:sEUxCSYDG7hBJ9g2RP
- TLSH
  T1BA8633A0B8C92770D097C3728243753E712D7FC5BE36DD2A36E9BA145D31A29E9B1708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2