295cb46b9b437dd8ecc5820204d277ce68bcd453966134f988eeb648960839fc

General

Target
lc.exe
Size 16.2MB
Sample261107-ynswjsfw2m
SHA256 295cb46b9b437dd8ecc5820204d277ce68bcd453966134f988eeb648960839fc
MD5 7441a93ef819c5787cec5c9ff652565d
SHA1 e8565e36cd97caf16be9fa3d772fadadd99211b5
SHA512 8ab7105ba3284c7cf4164b8db52baba1143236c465653deeb398a1540a2d88deb937b9336e8ff1c5af30a5e561c0dba1c8212d0360b4418cafa1b79cc84a7484
SSDEEP 49152:wNNZaN2maK0ZaN2maKmxn9d+9BJAiiWGgt9IPXY32Z0PYriUTkqyDaDXVLh5PAz8:Yx9
TLSH
T10F073038B9D518BE7B6759EE87F63A9D5909F3BBB3065D7C20B2314A43039098CE4724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  lc.exe
- Size 16.2MB
- SHA256 295cb46b9b437dd8ecc5820204d277ce68bcd453966134f988eeb648960839fc
- MD5 7441a93ef819c5787cec5c9ff652565d
- SHA1 e8565e36cd97caf16be9fa3d772fadadd99211b5
- SHA512 8ab7105ba3284c7cf4164b8db52baba1143236c465653deeb398a1540a2d88deb937b9336e8ff1c5af30a5e561c0dba1c8212d0360b4418cafa1b79cc84a7484
- SSDEEP 49152:wNNZaN2maK0ZaN2maKmxn9d+9BJAiiWGgt9IPXY32Z0PYriUTkqyDaDXVLh5PAz8:Yx9
- TLSH
  T10F073038B9D518BE7B6759EE87F63A9D5909F3BBB3065D7C20B2314A43039098CE4724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion execution persistence spyware discovery evasion ransomware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2 behavioral3