55bbf872437fb4eee1d346e4bfb62b997905f3c159b98a475611e441a363fd37

General

Target
55bbf872437fb4eee1d346e4bfb62b997905f3c159b98a475611e441a363fd37
Size 6.1MB
Sample260803-qwmeqszfqa
SHA256 55bbf872437fb4eee1d346e4bfb62b997905f3c159b98a475611e441a363fd37
MD5 439aac70cc37cf942cc527d8457da210
SHA1 7757ed770d6acb232bb069b877ce5584197338e6
SHA512 bdb471a6e6450eb2655c7a5483baf3e0504c2a6be3116299069625fbdb9652dc80584736f61ee93082ea12045bb6032970c89aeec63d6b976ef9831633990c24
SSDEEP 196608:AvTBXz4On4AX5kINU8QF4JbOeGX+S/Yb29:66HALWhiJbtF29
TLSH
T1B75633E8F7D1E26AD450BCDE739A177BA8811A4021C01B2833A491BDE7E05D463BFF65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_r4e006.msi
- Size 6.3MB
- SHA256 9f6710c530a1389ac224c86a1f7562ab657a5195e44322664feefaf105f6371e
- MD5 b7f9ab5acd8f4ce253ec31a7a484edf4
- SHA1 890f70fe91c9f65407f4555b4a20f9cd9c9e19a7
- SHA512 8977b9da3e59bc2ca1548543cf4693e8d09362e9ad555bebdc7eadfc008f761ddcb523c94fa5eab5e430df1a0f87e3dfcc50b91b21588936003e9a971a12157a
- SSDEEP 98304:rWFgCvTgmHp0O/3NUOThfP0IBZsQfe7qpdIpmdVYmFV6FXuagKW30QtTivLGX:QTgK3iOTh0IBze7Od7dUA/KjCX
- TLSH
  T1AA6633D4FDD163B4D097C7B94282796E7C683F45BB660E0A3AC97A286F32690137B740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2