e824aa3d9ad904c578359172922e89b5e3a34bcf94e08a715dae8726dcd762df

General

Target
e824aa3d9ad904c578359172922e89b5e3a34bcf94e08a715dae8726dcd762df
Size 5.4MB
Sample260730-kxllyavcmc
SHA256 e824aa3d9ad904c578359172922e89b5e3a34bcf94e08a715dae8726dcd762df
MD5 2b8581005a3f3071e97740567d54cba1
SHA1 49b2d8f3fa4c52954c5d408e58718e8cff678784
SHA512 b6cd57dcbdf4ee2c1c578c1402111b59772b0b4b6636c849aa6318973de32acac7edb7f1f9805587715770b635e4dfe1adc59d9056bf39d6c45c3dd9e9d41062
SSDEEP 98304:D/16qUGOxL4pZqckkW0Bvm7oU1piBglWGU5neK1gkKbOHa+wloVxNmxq6:hP3OxkpZVkL0Q7ziBgIZZeK1gkwVlSx8
TLSH
T16046332BF9D293606A2F47723766F2653D2F37B97DAAE29E58090410C384B31356CB34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8008.msi
- Size 5.6MB
- SHA256 f033c6824161a278a945274a140bbdb20fba0e22660168f529887ce0095b9118
- MD5 806b7beef77061cc933a743fa94d5ab5
- SHA1 30c81c073c990a396228056e5de431f5dc3f7580
- SHA512 753b4e56bf41e4fecae6e98019b055d7cc8c611aa01b300f27b2b5fe0ed5d045ba0c676c8ce931e683c972c3511fe91fcf473a8472567f6fe5efdc949fdf6e3f
- SSDEEP 98304:pQwGGOF7QjzWSm8WCJTMBucH4FQFlnyxlQMHsKB+ipxwzamC9IBbVmTh:pLJOFcjzjmzCOB9GmnyD1MKB+iDR9MbC
- TLSH
  T177463397BDCA6370C04BC3B2565232BD313E7FC56E75CD5B3A9935088E72A2128B6784
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2