0247c8783492c30552922c3b44f4d8be93aebae208f0ca09b9713537caf24ffc

General

Target
0247c8783492c30552922c3b44f4d8be93aebae208f0ca09b9713537caf24ffc
Size 6.8MB
Sample260803-j5798stzft
SHA256 0247c8783492c30552922c3b44f4d8be93aebae208f0ca09b9713537caf24ffc
MD5 083f353e5e5e4e25164d05aa51ec15e7
SHA1 64ad826e14cf4b9d9b48b27c38c6af1e492d1148
SHA512 4b3fcf294e3c4b7d7cb659465e9c2d93748ccae4c77b242932cd76bebd31d55de3ba562df40288f54bf39a07fe3505169d9a1c29e2d17fb63a1c2d3b6bb661eb
SSDEEP 196608:AxJuoMWtyvu0Qm4Z5WhDZGGWUMfyJJQHMxntAfWsiXH+Q:Aqzvu08ZuDZ/5MfyJEMDdsc
TLSH
T1AC6633EFCCF5A6869E8DF922534F439D66248CA7503E6CFD6F00A112B7C2811BD39895
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_m3ue018.msi
- Size 6.9MB
- SHA256 ca94b43f97e611dce9c7abba2983ad08438a5404c520b97d8e067c3e44fb3964
- MD5 85a6f66c5cc0a70b49491224f4e24bef
- SHA1 6c506ae1bfa2760c91d9f081ad9142840133074e
- SHA512 0151b4544bc6dacde7ec891fd3369208efb6ae081b4a867c57f57e2b8950ae4cbc21b657917a4c782d9ef2ae78fe6134b0006406c6e8a2f45697ef03e9e5b79f
- SSDEEP 196608:29SQZyxOY+4WXJTJlK9bU7beJnjC1MGErDsI:pxOYcX5Jlkg3e9VGG
- TLSH
  T1777633DABCC62775D18BD731420759AD3C3D7F96BA3A5C2F7B8836001E7251ABA31680
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2