f5be3fa934e1b7ed03904f003b634cd003bf10cafca08d60b2e7b6399cd65bd8

General

Target
f5be3fa934e1b7ed03904f003b634cd003bf10cafca08d60b2e7b6399cd65bd8
Size 5.2MB
Sample260803-e1d4da11b1
SHA256 f5be3fa934e1b7ed03904f003b634cd003bf10cafca08d60b2e7b6399cd65bd8
MD5 8b95389f5acbb012e5d616f056cf3478
SHA1 0eac551cb5fcf5b6321292d4f60c77cd0fcd1409
SHA512 fee19fa2b43499c8e52b9c696d028e5c7ea14bb62fe9bf1b7dc6634e3fd69da8b256e67689c716c4976381491f8774358f4520f84485daf3ca8be4568f03a688
SSDEEP 98304:EZ/iAhCuDZWFUq9pAg04rIQM0AJ3tvpi63zsUBYm1hNwPolzyfjv:8iAAn0Ky3S6z2m1h1lzyfjv
TLSH
T11D463365CA642387B0C561F0B7A9BCCD9E3F93129BF8E874602C576AB8B706D8DC0C55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr009.msi
- Size 5.4MB
- SHA256 61a8c76d69435a132738bdae1616c1422c930cfc4677f57c7dda167b69df14d5
- MD5 3261b381736e70cfc34077f0946632c3
- SHA1 de29ac5f6223c8af0360779a01ec375e6841ef86
- SHA512 54ce41e222d228782e89446fdf807573210127f679740c800a72723904daec5c17ec149a95c123624f32c0dcb255639e17f2b6cf9f9980d6265277a4de669e9d
- SSDEEP 98304:gIXVHPSJvYH7cfWLE0XrS20YXwuIYAH3zEJsx7/Z59rzgoR3wXp7ApG/9y/3A:BGvYH7pd08w3GsBBX1wXpV/9y/w
- TLSH
  T14C463391ADCD2330E08BD3F4A557719DB12E3FD62EB58C1638DDBA2C5D3322A49B5281
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2