509236b75ca53f7e5645a39880bafc686e5a7584c58160a92332deffafcf73d9

General

Target
509236b75ca53f7e5645a39880bafc686e5a7584c58160a92332deffafcf73d9.zip
Size 7.2MB
Sample260712-ggte3ads2l
SHA256 509236b75ca53f7e5645a39880bafc686e5a7584c58160a92332deffafcf73d9
MD5 b4cfec66bad4afdb477fed60b046dd8f
SHA1 caa0dbfc1d46845d470379928ff680d9b27bcbfe
SHA512 137b14e92837a3d3387abd550f3d85797880acfe1974fe6b3c390842d781daaf4c4dadbbe1af17739d9b302e38d7045a688df35bf5355348f966e5a32451e1e4
SSDEEP 196608:f+uQoohBuf2fWb/50TbGrd1u01L9wQTkpEg:v3o/uHqAvzTkpF
TLSH
T1697633769F04F5A0A12F0F5E080117CE839AF4DFF369B817719899F4A5253B1E98387A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.6653012.msi
- Size 7.4MB
- SHA256 eac9597153bf17bea92b1478b3b585e3a82d084dc84a97bf359a134289c6cf0f
- MD5 fe87ca6414094482b9ce161cce802c57
- SHA1 ebaa7cf2a976a6f45bb75b5e01354d5f848ad51d
- SHA512 e59883e0f64e161545624a3d4f702164212a57ac0f3c16a691313315296fc527d88b4492cec64da65c0d74c524751778d5af57f4616bec4d56b2a4f2e00b2213
- SSDEEP 196608:kImeVrS2ssohTmflgU6nAm6L6HR72ChTXoaTGb22:TVN5oZmmAxOtJTGbF
- TLSH
  T1A67633A6BEC4B5B0D007C77A400263AF712DBFCBEB359C1676E9799C5D7232094B2249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2