33ca13cb75bb4a4824786b011ffbb5437efe6663fe76ce1f48bb5c0a54497fb5

General

Target
33ca13cb75bb4a4824786b011ffbb5437efe6663fe76ce1f48bb5c0a54497fb5
Size 9.1MB
Sample260713-d1rtssdw6t
SHA256 33ca13cb75bb4a4824786b011ffbb5437efe6663fe76ce1f48bb5c0a54497fb5
MD5 674304e8d15b6e21a9a2a8d67f3bdfd6
SHA1 8a50a58c9db411907081773e46b0b7e6459acfe5
SHA512 3fd4fd43a5906b52819eda658574b434b9243779003e6b3aa2c84fef2c22e36edd09fcb4e84f534094027e5f82f4038349be8048eddc2e323efb5eb8ec2734ef
SSDEEP 196608:dxVzj4agE012q4SZakB4Fr5UGBpKUWqPKju6Xh6Dj:dxVvG1Qscy8pKU8uWc
TLSH
T11DA633EBC443CA9AF1EA9C4608A63F11001CE069E5BD59AE7C602C47D5E7510BD7FAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  app_setup.6653007.msi
- Size 9.3MB
- SHA256 ad4a584f5e622c10703bca28c58ee8372899edb48cc1ccf28a2cff87d1afbf2d
- MD5 ce4907cacd3b212e5d05baa6f6a8ffec
- SHA1 e154f026d9135b568253a21271f215ba5acfc620
- SHA512 cc9a54b7c1f0758c73012d8614d175f23000c7f705603d097710df56faffa42f19c6536e2688b7db44e0d53e44de866ba6fe253be4e55fcc18cf9c26f581c052
- SSDEEP 196608:G1UU/jiaIAyxWgWesH90QJNU8ZLuAcYPqzUgZB1/B:wUE2xAXV2+LuAkUYX
- TLSH
  T11CA633DA9C871975E06BC77005A2322C702DBFD4AEB90D0E3DE53A0D9EB25106D776E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2