5ecdb1f51624023c90922d435297ad714be95632417808d95d906e8791436ca1

General

Target
5ecdb1f51624023c90922d435297ad714be95632417808d95d906e8791436ca1
Size 9.6MB
Sample260803-tdtymseq3y
SHA256 5ecdb1f51624023c90922d435297ad714be95632417808d95d906e8791436ca1
MD5 028d32d21b77308a762adb8243e9790f
SHA1 84ab08e6c74a8d63f7ea80d278013f6d1d3b4155
SHA512 bbbcc5cca33bd77a138405e2ebe63e26af0a9df4212f276b89d60b5deb0603f954b67deba11478db64387058efa1c4a9f1a427a0d5eb43711ffd8999d59afef2
SSDEEP 196608:Q6GiWzGHY1Ix9lRsUSK8XLIIyf3dETEe8tctk3h6twFZ7Z3:LnWS8Y9lyUNE8tctkxhFX3
TLSH
T1AAA633AAE99581FB05F50DAD0C25C2DACA1B4859784FEFF7091BC39A900EC04D16BDF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_r4e004.msi
- Size 9.8MB
- SHA256 dbfa87e5c8c6dc2cb0a5f317d9c48b52a907bd422cda6d79b18cd1bbee480e60
- MD5 d056fc1762cdb05aa5f3c2eed4fcfbe4
- SHA1 18986db15e5f3ab3dce4633aa431983436b49632
- SHA512 f35eff048dcc0f1f6cbad91c7babebcf9bc867b707ea5ad58ca2ed9466e420c051945d49b013fac7a78ba7ffa6fd933671cd10a2ad476fead61f9a3a20fe00c6
- SSDEEP 196608:pMSnCfNax2l+V9Tdq4iHQqCYII4dLfO9i+yROvS5JJKdAfFdx1:p00AG9TEfwh7O0ROvS5P1fN1
- TLSH
  T172A633C6BDC666B2C097CBB9004261EDB12A3FC67D179E573AAE73046837A11E4727C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2