42ee1c9da86f23b764269370424d2435f0c02c88ff8c7313f37d4caeb214698f

General

Target
42ee1c9da86f23b764269370424d2435f0c02c88ff8c7313f37d4caeb214698f
Size 6.0MB
Sample260803-elplkayapd
SHA256 42ee1c9da86f23b764269370424d2435f0c02c88ff8c7313f37d4caeb214698f
MD5 866ead414d501ca20464504ccf9b4d25
SHA1 d3848a134bfc191ef93ac0f7ba6f0ca519d817bf
SHA512 2524d170354bd3483910e812b9bd165b2a8d22d2cddf3b055b0f0472ccac730c3b62cefab9d1facbb74680897542d3fd1675132aa9a74cc919f53952d201cf03
SSDEEP 98304:QSxiaNe3xPZJoIhXOkf9Xpv7zcEv3tbmxqWufhnYnQrScTSF5Mf75Xp:BexPgIhXOk1pXdbef2hnYmY32dp
TLSH
T176563386979982DDD867C7204D3964F4BB01AC2EE807DA04D886AFFF6349F8D949C0F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr011.msi
- Size 6.2MB
- SHA256 2fd1f2346d0e0b959ee275f56d3a38241e2a9d2a1752ec60f9ca35f664c90076
- MD5 231f6a45fd243c28c440475823674a24
- SHA1 9e94301cd1e05a570148b037c912e0dcb3982c91
- SHA512 f1f1fd0b2b3e3d06261cf0af2c5c2fbf20d6a13c45e4388ae3273c86ee3333209588432d708345e9436b76813ccad9f1cdc80444cc980a17fba8891d530716db
- SSDEEP 98304:6aIUmIpe1TLx3oIhj8khVyCMmuvDx90bmZeWzvhYFOjoEd8DhOn9dLR:68OTL2Ihj8kHMmuvDL0bSeMvhYcm9sxR
- TLSH
  T1AE6633C5BDC923F5C05BC7709A2234AD7E29BF58FA234C0ABA897E101F76B051778295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2