d81696057642cc78e14200a492460c4b18c6eedb1dca115a66894424b03c455e

General

Target
d81696057642cc78e14200a492460c4b18c6eedb1dca115a66894424b03c455e
Size 6.7MB
Sample260803-ewxd6aybqf
SHA256 d81696057642cc78e14200a492460c4b18c6eedb1dca115a66894424b03c455e
MD5 2ef2285aa1ac6b6b8ec045b07908b1b3
SHA1 b8bea384318385a6af193000252ec40b7bcd9840
SHA512 4b485d1d9a699226b2e5dc82c98f88f91df6ffcf89bd8db2177920d58304ab2ffa1dea285e09196baebcae23476799925ee5fe1972879eeede92ee450732278e
SSDEEP 196608:KjXTDAIQNxiE6Yk9PP55MuA3OHZapZJyWk88:KLfAvNSNieHZap6188
TLSH
T1DA6633385727AF41CFB0F9923DCEB90C9467EF2178229FCAF876F10949506257AA7610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr010.msi
- Size 6.8MB
- SHA256 29affaa5fc4c41df6b2a6c4a00a842a3df060e2b9f2ebb787c2c524d84ac08a4
- MD5 ac52df2766aeb709d4d9cd22cc4157a9
- SHA1 83972c03b9eac99305cf05453634755753b8091d
- SHA512 fc2ca6e05b3661fb69afd3b0346ece51dd5f5ab7100683ea75adc1137639c66f83a2c908914c7bedbe4da4424c0fcdadbeed7dcc451c4a63c9014a0df95f39ab
- SSDEEP 196608:+jh5lxqmIN1qEjEjWBS6kVsPRGVLZ8Widf:urqLNPEcuSPRGVi1df
- TLSH
  T1D27633D179CB2BB1C59BDBB16147B86D3C2A7FC67D224D8A75AC76042E723292273340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2