4d49d56851f595751f3f8ca8d5d367a6563f4b2ca3a92f426be0dce27cf09afb

General

Target
4d49d56851f595751f3f8ca8d5d367a6563f4b2ca3a92f426be0dce27cf09afb
Size 6.0MB
Sample260803-elplkayape
SHA256 4d49d56851f595751f3f8ca8d5d367a6563f4b2ca3a92f426be0dce27cf09afb
MD5 384b8a805d76275577f66ff292d7c002
SHA1 a26d28cc1d278a2f04f6989bf9dee93cd9dee77a
SHA512 ea94cbce8f3d33071a5242d8ff1e44e0c80cec92e2cf205089d2baac0325d9e9c33941889061fb12bc807e1edb7f8223f55c9dcd28248761804ed0f30a88fdac
SSDEEP 98304:wSxiaNe3xPZJoIhXOkf9Xpv7zcEv3tbmxqWufhnYnQrScTSF5Mf75XP:hexPgIhXOk1pXdbef2hnYmY32dP
TLSH
T1E8563386979982DDD867C7204D3964F4BB01AC2EE807DA04D886AFFF6349F8D949C0F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr011.msi
- Size 6.2MB
- SHA256 8e9d960424ada640a47eac0f5482e4f521de98c86a6dc464dd0098520ba0e7d1
- MD5 49ca65b5ac44eb975497292235536b2f
- SHA1 9bb390d0305ec44757546749f6716aa52369d141
- SHA512 0f58e7f9a06043d3dd31946edd7714c0c544ff4db0b82eddb22d1192f84ae7e1807e80c45c80493efb6fbba646461502c57a0d7eac9544c67243a0f42ca3af14
- SSDEEP 98304:6aIUmIpe1TLx3oIhj8khVyCMmuvDx90bmZeWzvhYFOjoEd8DhOn9dLR:68OTL2Ihj8kHMmuvDL0bSeMvhYcm9sxR
- TLSH
  T14F6633C5BDC923F5C05BC7709A2234AD7E29BF58FA234C0ABA897E101F76B051778295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2