850f3f5a9b8ab7831ad94893c6a6f9d456acc362947a81533b81ebd9b5f3f251

General

Target
850f3f5a9b8ab7831ad94893c6a6f9d456acc362947a81533b81ebd9b5f3f251
Size 5.8MB
Sample260803-ftft3acd83
SHA256 850f3f5a9b8ab7831ad94893c6a6f9d456acc362947a81533b81ebd9b5f3f251
MD5 0881973cb6e777aa59588a19ce99361a
SHA1 3aa06f2d6274bdd3adc65b56fcee81ba6bee3e03
SHA512 12728d30042a1fdd3373f1cc77628fca611313b162003e9b8966bfe5dfc0860a78bd5fdf9219bd73a819a421f0210360e81de91cef4e0572dfe99f0bbe3f8ff2
SSDEEP 98304:EkyUtMC0w/GPFfRIKQ0NQ0I609iQKAzyI48K158VZ3s4Ah7tQkkz5Z81BIPT5XrW:DZtF0w/GM2QPj9iQKAblK158VZ3s467d
TLSH
T1AD5633A52C72E35B8063539DD3429EB64CDBE8B610719A8D8F077FA78443DC86FE4920
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr013.msi
- Size 5.9MB
- SHA256 fb8b4b733347c3ab0feca0e91fbc506e74129a3f1e9e3c93fdc55310cb82323d
- MD5 cf22f6d4c0a720f15e327be47189afd5
- SHA1 9f1fe519b3c2ce32250b7a6ec70822d02a9ef9ba
- SHA512 ac98a45ba6d59b8b1033e4fbfe50c70e1aa24e3d96ceb24040b555b2a193adb164ec9c7380c58951583f8fb281860a568bd6f120199316452d9c1b947eb15463
- SSDEEP 98304:jJdzXYllrgYXrG33/mMyiC/0u0AkL2JuRT2Ni0pr4PaL4Anfkr0WkDLZ8LBCrNdJ:jTzIllrg+rG3PmDv/0u0APiT2o0prcgj
- TLSH
  T1B65633D13CC61335C097C370820336AE722EBFE6AE759D0E9AC9BB490D326395675399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2