ee48c388ef949dc59f4a2ddd3fa21549e42510aba774bb6cea8f74732e985337

General

Target
ee48c388ef949dc59f4a2ddd3fa21549e42510aba774bb6cea8f74732e985337
Size 9.8MB
Sample260803-jl83es1fle
SHA256 ee48c388ef949dc59f4a2ddd3fa21549e42510aba774bb6cea8f74732e985337
MD5 aeae3ca6c900d5f4bdf7930748f88f3d
SHA1 62349636bc2fbd80e5650ac2aba7c4e325915e20
SHA512 dc427e3f164ee1b07553fa418713fabefb15210eda833169ca5ec7ac15cbfbbb0d2a312845d88fd8c3ca302079580b4f395980f89ce9995a560e7b370354c985
SSDEEP 196608:jfwjScZn7i237AOAl5yJ0bAw+dbcoDZremM7Qx+PveGH59iihB2a0QuY0UkFw:juZneMA008vbcoDZKVQWmGH59i62a08P
TLSH
T1DBA6333AB8B4B819FFC2C877A1D18C0B0B579CD8C6304F3CE999CB599A6696345F8D05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_m3ue019.msi
- Size 9.9MB
- SHA256 6736c19a17abccc5a0631d57e952e4f2cf6867c9adf60b787a26119fe2738e77
- MD5 7cea913926199ff28effef7277ffa844
- SHA1 24cb97bf8ffc15c47be0c8af54f642f018e377e5
- SHA512 57c71696b6f795e56d2a53360d55e5e9d4d5b9e89a16b121e74ea991f7a95c6e3ee0b6d1da787b3f2fd341564346e79dcbf5bafd6e770b76f2927b54e7498b03
- SSDEEP 196608:LG4rf1okp7YdqX+wk1VkwUvmO2Z/sA5tjeiYjQlOFL0YD5PsgtH+U8e4oI6gW+zy:LBrfyEX+wkBUON/sA5tyLQ0YYD5PsM++
- TLSH
  T1DCB633A53CC97670E68BCB720042286E3E2E7FC4B7624D15FE9D7B141D7362286B6709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2