949061914168c2c2b301472c6478b5d099774ed2aefcab1fd259b304c79762da

General

Target
lc(4).exe
Size 16.2MB
Sample260910-z2y56aytes
SHA256 949061914168c2c2b301472c6478b5d099774ed2aefcab1fd259b304c79762da
MD5 e10bde317baf1adca2f14d66b1938112
SHA1 88187f9edd18bb557e9ca6004100e500218dffda
SHA512 5a71830870ba7c938d909aecda503212c69c9b42cb67daa01efe3ae39bf0292a0f02f0535a9c57f9d07f54e9c7542df0a4b62757621bcea637ce0a00437a8046
SSDEEP 49152:1xn9du9BJAiiWGgt9IPXY32Z0PYriUTkqyDaDXVLh5PAzuKTW/UMXkRRJzS6i0sL:1x9
TLSH
T135073038B9D518BE7B6759EE87F63A9D5909F3BBB3065D7C20B2314A43039098CE4724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  lc(4).exe
- Size 16.2MB
- SHA256 949061914168c2c2b301472c6478b5d099774ed2aefcab1fd259b304c79762da
- MD5 e10bde317baf1adca2f14d66b1938112
- SHA1 88187f9edd18bb557e9ca6004100e500218dffda
- SHA512 5a71830870ba7c938d909aecda503212c69c9b42cb67daa01efe3ae39bf0292a0f02f0535a9c57f9d07f54e9c7542df0a4b62757621bcea637ce0a00437a8046
- SSDEEP 49152:1xn9du9BJAiiWGgt9IPXY32Z0PYriUTkqyDaDXVLh5PAzuKTW/UMXkRRJzS6i0sL:1x9
- TLSH
  T135073038B9D518BE7B6759EE87F63A9D5909F3BBB3065D7C20B2314A43039098CE4724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion evasion execution persistence ransomware spyware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1