eec5c7f38447dabb605cd2ec417def3982a4c90a57fd4ee4d2f4251a5f093622

General

Target
eec5c7f38447dabb605cd2ec417def3982a4c90a57fd4ee4d2f4251a5f093622
Size 6.1MB
Sample260803-r6w8csscqh
SHA256 eec5c7f38447dabb605cd2ec417def3982a4c90a57fd4ee4d2f4251a5f093622
MD5 be6ee9d1c77e6f3322f72e49a6c34475
SHA1 1eb545d060306eb376414b741dc4714d0bd97e8a
SHA512 4512324e620ce2e4bc4c72c26c0542e812d7810285fa4a89e31275ac5d6607f61cd1b0a8e3656762f832889def552487af848ce4a6ddb664b455c183d5a0637d
SSDEEP 98304:G70GIyxt57QUWec0PemNtPiSH7ewRjCoUAi7Rg4khG7F9+4Tf6W3:G70f+ER0m06oxCoq+4Ok9xfJ3
TLSH
T1485633CD31AF1E42757F1FC19064F92462826A6B269AF052FA0DCD81174FF9174ABE0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_r4e005.msi
- Size 6.3MB
- SHA256 73ebe4c250a7458e03596581d4593aa77d8bc0dc68ab2053db30cabc7a54d033
- MD5 9f2e48823c5797cb77bd827b86bd4a17
- SHA1 9ccb71cbd6d2cf1a18e1d9abf35387699ed8406b
- SHA512 28e2096f8580ca3ed1db0ffef3c51e9eb026fbb6926a8f97d88b4eee27e405f3588b1e35d14145150c5bfdb7dcf3b7a4e4d3c91b338d5994556af564b667775c
- SSDEEP 98304:GrDPtMMCrVdyGay0xw6lt/qgDBgNMUYFkkaIhQca16R7zgCTxiciT:GrJlCrlt0i6SRyUYFkC2cIOzvxDiT
- TLSH
  T1666633C4B8CA2B71E0EBCB725151B62C711A3FC67E66AC17BA9DBA400F3371514B6B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2