89bfd9136629337ef2841dd39ecafc6538b94e850f12da8f76934ef67a812ca5

General

Target
89bfd9136629337ef2841dd39ecafc6538b94e850f12da8f76934ef67a812ca5
Size 8.8MB
Sample260719-ls2m2agx9r
SHA256 89bfd9136629337ef2841dd39ecafc6538b94e850f12da8f76934ef67a812ca5
MD5 7ce16b8a0459e4a100afacae9332dacf
SHA1 dd543828fac0ed237bc31143f1cffe21798104e0
SHA512 af9d4702658c6ce32e602da209ebed0575d239529587ab891c1905e3e333d53b34a1ebbd07656167244527571f98624132112452f299ff811b90b75610ec0560
SSDEEP 196608:0V2ftEwTelQaERqlLZd3WhnSNi4jE3T+WLCOrqEN6idkM4j:YK6wTagER4SNlcVTqEN6idEj
TLSH
T17C96339669558267E0CA1D188EDA38FA921590CD5D4E8AF3ECB132DD1E33F6FC6043C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  installer.8332566005.msi
- Size 9.0MB
- SHA256 1f3a9360c89404496b786b8eded1190b7c2a1d30759962edee75c2ffdc447b06
- MD5 d6a59483d76772e53d69fd53d42abdd5
- SHA1 0d771d87be554443fd239a52222baa95efff9b6d
- SHA512 ba1fe66939bc203f4d71af758e98a4c13b0a30ba145062c4b3d5fa5cbfa35f64adf995b716f253bc63eb844e719b4f0e5b064a20cf4a39efc3e10da16be3c407
- SSDEEP 196608:+cZh2L3OUDidWaEFN/4S8bKhWPxerSbOri9nI6RyY5oiHMAhGusZ:tceUDA+3/dewrR0ZLoiHMAhmZ
- TLSH
  T1A09633D538854332C087CB70468734BE79197F85BAAB8D677AA837442E33B3A9735385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2