539204b8212b103ba723947fd5ba04d335e79f5b491eeb5403fd801b96948941

General

Target
intall_app.66553006.zip
Size 8.9MB
Sample260717-k2jcdaf17k
SHA256 539204b8212b103ba723947fd5ba04d335e79f5b491eeb5403fd801b96948941
MD5 f86a1a4e12da091a69051943a8e38fb3
SHA1 636a9efa9fa256ee3a6b144667c4d254a2a7ac8b
SHA512 0a8376adc63aaec4dc6a6c8038f9e3e32d77e4a3878d78f36b38b91ccdb9ad07c16013c2eecf3b6db730b44aac69137111d1e31e2599dbcc5f78ebbf71fd2e87
SSDEEP 196608:/agkKxPkBMf1lZgt1vBVayg/sz/2QbLanTJI4mskpB2:xJkdrBM0uQzI
TLSH
T1819633E8F61FEC901C037579F918AB24D8A333586CA2BF6F4A20E6572D970795C6E05C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intall_app.66553006.msi
- Size 9.0MB
- SHA256 f09b468e14dc427a7b62e28f4069a6cd61729c00ef459fbd1ec99f8d6757ac08
- MD5 b774a9bae7bba2f65276d7431b455097
- SHA1 38c55ceb6be6c53d78fb2028cd65f5a12f277282
- SHA512 76faa8cda8ec19dbfee3f2d385e9334c4bb5b2746e5ec1316d0caf1664e297fef6401e80e14d1ade11165dcf1974b3540b1accb77a6b1ea1a8de10125b472164
- SSDEEP 196608:X/mVqb0fG86ytX2jSxZrS9wl/kvB5xLWW+xOr5wQxLob/Rk4HmwPTw:PmVqbn86yZ23vHxa2qQQW
- TLSH
  T15F9633C4FC8A7F74D547D7B49052746EBC3A3FD4B9A29E0B7A84BA001D732254A7B248
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- SilverFox-style Panasonic/Sauron loader chain targeting the staged Panasonic wrapper, image-named Al
  SilverFox-style Panasonic/Sauron loader chain with staged loader, Alibaba OSS carrier grammar, side-loaded UxEnhance64.dll, RPC Task Scheduler payload, adoresd bridge, and Sauron Edge stage.
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2