7331eb7b373ea22bc5f13763a4b5fa3501268c843c7c23731ef5aac1b5600c39

General

Target
7331eb7b373ea22bc5f13763a4b5fa3501268c843c7c23731ef5aac1b5600c39.zip
Size 9.5MB
Sample260711-2f7arac14v
SHA256 7331eb7b373ea22bc5f13763a4b5fa3501268c843c7c23731ef5aac1b5600c39
MD5 27f86732d464c8314b8a5a69b3472419
SHA1 081fbbf11ed8c3d0e53a0fcfdfaf00f315103c61
SHA512 997df6586b2a86c936748214e46a64f5f8020634c3964d8cb7c2a32b9c59c6fe5458f31fe5125d8da657134018b120ee30c447b4941ff2014078d508065f717b
SSDEEP 196608:41jQn0RltIpwpIZNnxjUMemD+UUQqq9FQhOC+Ky4fWcCX7i:4j1ntIpwAfUMkUUQqhhOyy4fWcz
TLSH
T182A633A076DF0092068796843E54867AD8A482F92FD00A2697D0DBD3CF539E4BF77CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.6653008.msi
- Size 9.7MB
- SHA256 ae0f2bba0e3226ca28f3d54f1eff26465735dceddef83fbe60bd64bac1e3a7e3
- MD5 b9e3e2ac65cab92ac01983567658cb0f
- SHA1 bddd2800c644d76779b2d4ce85a89465ced7987b
- SHA512 691c3e09641625c10e28ec09a19e1970305175448841272ceb830bf041152fcb04beb4438102d867abe8976e3dd687960a12c6b45999f6b775e84771910d029c
- SSDEEP 196608:iEXfU34m3qRRF+vyt9WGcRNtCKmyLOS+GKe3nGVaOR4OLqgY5fu:iEXfpL3F+vy2RCK+S+GKPVaa4OLqgF
- TLSH
  T12DA63391B6CB0570C01BC7B4964A927E702C3FD51FA00D266BD8BF489F73A642E776A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2