9913126d88bb4ba8b62d0b509ddb6b36969189702bd83b9fde4ec7c61d1beffc

General

Target
9913126d88bb4ba8b62d0b509ddb6b36969189702bd83b9fde4ec7c61d1beffc
Size 6.7MB
Sample260803-eppqqs1zdx
SHA256 9913126d88bb4ba8b62d0b509ddb6b36969189702bd83b9fde4ec7c61d1beffc
MD5 34a47c4cd2f7634f57f78a9d11c3e23e
SHA1 769c33af5fec4d39d1889e5d71f875f50201b3d5
SHA512 522f2ce4dd3d8ae0ef92f879a81feefa2e14237b44531aa9d55721ac427bb85ddd0d99378d32e85aa0b3aab87a6591a98c501cc53ffeb3a8950d625c775bb000
SSDEEP 196608:ejXTDAIQNxiE6Yk9PP55MuA3OHZapZJyWk8/:eLfAvNSNieHZap618/
TLSH
T11B6633385727AF41CFB0F9923DCEB90C9467EF2178229FCAF876F10949506257AA7610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr010.msi
- Size 6.8MB
- SHA256 2d6f51c5cb1934600cc2a7c2ff1aef873944c28651cf2c3595419604f9406249
- MD5 e6ec6aef89862dc42899c7dc1f7b6033
- SHA1 75ef765385fd713ee1373584d3056171277c9500
- SHA512 84193d3c04e860ddd46c0852d7b9e47015a6e93f3c195df00c11a2890564330a50045402f25c562c46d684cd3c4433e91bb09fdfd7730fef16be37e981bc0d10
- SSDEEP 196608:+jh5lxqmIN1qEjEjWBS6kVsPRGVLZ8WidV:urqLNPEcuSPRGVi1dV
- TLSH
  T1EE7633D179CB2BB1C59BDBB16147B86D3C2A7FC67D224D8A75AC76042E723292273340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2