081f1a00ef7128890fe7e3513c71554659a9c3ef2bcf61080cb82f99d2b375aa

General

Target
081f1a00ef7128890fe7e3513c71554659a9c3ef2bcf61080cb82f99d2b375aa
Size 7.7MB
Sample260724-ppgp8sek2s
SHA256 081f1a00ef7128890fe7e3513c71554659a9c3ef2bcf61080cb82f99d2b375aa
MD5 0170e21fab72c434d8fa0ce9a619c971
SHA1 38147b20ab253bb9c800d9d3e2cf177998b16fa3
SHA512 eb91ad75ca90399a16651a2538d889312c82fdc16e83940934d5fc650c2f06574d9da8575879e337dcb4a35ede403fd56c3b04989201c59e2e95cd06b5c2e7bd
SSDEEP 196608:3U0EZvGNNafBKU8BEs0IgUCcHmirbzRuD8OpCJ:3xB6fBKBr0IgUhGirbd6VpI
TLSH
T15E86334D5FC9E8D06ED6945DF72027244EEC4444E13A820922B2709BA714EDFFB29E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intll.0.88020.msi
- Size 7.8MB
- SHA256 59c17b04ce87b524fecad127213fe1ffddefeb0593b34727fe9e64a25082ca3e
- MD5 41a37e85b01b6646da84b5e014b70f76
- SHA1 33d597d8055c59e061c8831304b1aa4f383abb4d
- SHA512 940641e4c47786ace53916e236645f0eb45309ecffd77ac09d1d8ce104d67420d9d9a516558309e8eada4aa7f5523a72579713511e39833ece0752ca5a57c1a7
- SSDEEP 196608:l1x0mI1VyNra3fapU7jIFIsGCDSirx7XcLsYhKG:l1xphs3fapUjIFIs5+irxTuVht
- TLSH
  T1768633CD7EC97BB0D1C7C374E2427A2C7D197F84B6368D0A369478415E32B2A1336A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2