5c5ccec62e06388e3a6af53a78ddc61aa08262b6b949ac6e6cecc383a3c1133c

General

Target
5c5ccec62e06388e3a6af53a78ddc61aa08262b6b949ac6e6cecc383a3c1133c
Size 9.5MB
Sample260702-jty77aet5y
SHA256 5c5ccec62e06388e3a6af53a78ddc61aa08262b6b949ac6e6cecc383a3c1133c
MD5 e0e30d9304ba08ac88ac048749620c26
SHA1 62c881cbdffbfc2cfd81ed773a1b29b46e40ff0d
SHA512 ecf1c1e44b6ef1cda9d798181127cb1db99edd031ab6d9fb2034bf6f8255e0f89ca4b87c02592d955fd85ce570cd6cce7df59cf33f260f43fa44304331b9488a
SSDEEP 196608:LQsjjtPgqUtoN7FCtvfumAmCv+5Xh9JgNLksD/MPhiE+d7CUI/nE57K:LnB5/BCVGmYv+5XhTCL5gPcd7CUonE5+
TLSH
T120A6339C6E79DC9E8E66835647F809A8F2625DF00FD1AF345A56E1A9F8CDC0D508CCC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ainstall-setup63890010.msi
- Size 9.7MB
- SHA256 727db312dc8d88738e784c90d4134ca02bbd1c9cc6cfb4b6398629372a9e89c9
- MD5 337ec4a029d1276c05d8610dc314b5c2
- SHA1 e0523ae24a5b70bdc1c9739e0684a6f610b70cb2
- SHA512 a0db4af2c6069a11e1ce1a867a81f1e8fa859906d5d20a6ddac44cef7d5c1b4dac0509900efdeaa2b89bef190bd74e39cbfccf0af3bd92287b3910547e87a021
- SSDEEP 196608:8qaFbZjGJE2SdCdqINt/QzvU+EaCXkLb3XDg73kGRpwNR2EQdVaCw/tgtxo:DarWfgj8+yXkLb3TE3FkNAZVaCUtgtxo
- TLSH
  T1E9A6339AFDDBAEB9C00BC37543965A6CB0393FC04FA18E2376E5BA0C9C7590854B5781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan adware spyware
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2