807a30c040056bdc7f8d785c031008eb120892c737d190e837807f745ed3dca1

General

Target
807a30c040056bdc7f8d785c031008eb120892c737d190e837807f745ed3dca1
Size 6.7MB
Sample260728-ltwheatzds
SHA256 807a30c040056bdc7f8d785c031008eb120892c737d190e837807f745ed3dca1
MD5 cd28802bd63fcbe7ed2f0f24a17bd4e0
SHA1 1e7e50334fd3ef0f935da94e946110b47de1c9e9
SHA512 112b805a7f4a94f2a6125b5a51965dfc843b866f5b15c960cb2f5c9960cab90e86efd842b4abfc7c85bb07cc447925d346b5dce243bfcda0645a83ce780098aa
SSDEEP 196608:HDA+utIMic2/67Dxv+fX2aGyTyBkOcOmaQxiSp9o:HD6eM72aDxm+aGy+cOP
TLSH
T104663333FCB764497AD7A1D97E0EF03E262E1FB106042D61F2892839BA12D57459EC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_966r30003.msi
- Size 6.8MB
- SHA256 e4ac3902d68ac3cb3950c265aa641117413470b55d3f8a88b78eebe282ffe5b9
- MD5 b9952028579af1bc8f332276c8803481
- SHA1 15fdf3ca442f186620620b9bef901dd2a1d43f65
- SHA512 1fa5240b47d1c44244a6cbaed88ac34138dcd713da18e386ee3822bc290f0f22a144269b61f2fc89e2c13a1a42dade3fdedd9efbe8c566b3f9f8366781ed8508
- SSDEEP 196608:7MGo4N62fIcA8YP3nqvLjXojUiTYR6a0ySCURiIt9Pi:H71QcVYYL0jUiw0y/
- TLSH
  T1FC7633D6BCDA2675D09BD7B05507A17E313E3FE03E269C5272E93A086E33B2740B6605
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2