5f14544b87794a20472bbe07d4999834bf3f4ad5eb6d195f8a08d328129301ee

General

Target
5f14544b87794a20472bbe07d4999834bf3f4ad5eb6d195f8a08d328129301ee
Size 7.7MB
Sample260724-pl9lvazerf
SHA256 5f14544b87794a20472bbe07d4999834bf3f4ad5eb6d195f8a08d328129301ee
MD5 0033eb64b15ee905ebe7c10b49bec9ed
SHA1 73f2e3fbf771885bdeb07f50ffa6220ff7a3ba18
SHA512 e05161cc3b588c22ed50c1fabf05adbd23576877b0d92eb5ae93a69e7a7d7623d046df837bd60aaf053d2aefbfcfe283ecc96cb7b59a3a1caf8eec178d4eec0e
SSDEEP 196608:6U0EZvGNNafBKU8BEs0IgUCcHmirbzRuD8OpCc:6xB6fBKBr0IgUhGirbd6VpF
TLSH
T1E186334D5FC9E8D06ED6945DF72027244EEC4444E13A820922B2709B6B14EDFFB29E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intll.0.88020.msi
- Size 7.8MB
- SHA256 960c7eeb349bfc497ef24a254fc7afdd672bf8aab698409512b16c3c62b15e4a
- MD5 9964336c4c07105cf0a49d41b44b6fbe
- SHA1 0a21df0c9cb420d304c238612746c4c2f48d3ebe
- SHA512 22a2f2e060738c14794ca1b53026527a5488dc176746ecba90673735017b27841e49ec3b59764997464472ca312bea9f58553ac38f6990d96e4ace4605ab6cda
- SSDEEP 196608:l1x0mI1VyNra3fapU7jIFIsGCDSirx7XcLsYhKq:l1xphs3fapUjIFIs5+irxTuVhB
- TLSH
  T1658633CD7EC97BB0D1C7C374E2427A2C7D197F84B6368D0A369478415E32B2A1336A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2