ba8fb02ff98cbc6e5d21d7415be00202d5ac997e0fa89ab021d617ed070b03fc

General

Target
ba8fb02ff98cbc6e5d21d7415be00202d5ac997e0fa89ab021d617ed070b03fc
Size 5.9MB
Sample260721-yxvrhatdrd
SHA256 ba8fb02ff98cbc6e5d21d7415be00202d5ac997e0fa89ab021d617ed070b03fc
MD5 74d8ee0d48afa914d933452036d76a1b
SHA1 79c610c5fdaa80bf46a13f75cdb74570a252420e
SHA512 0038d000bdfd1f2e82f15beae0d3667d957ee4e8a1ae18e7d1585524d6a313ea8087d8a7261c73e6bcebecd383d69df7ad66480814080e9ab416f0bef8c0dd67
SSDEEP 98304:PCADKAT22K+tg1KKy4mCwIZDuths3PE99KVZMENWkASqVOQ4oG4PQoZgyeoNdhtr:PC2KAT8sgwKm7IZq+E996NWkASwOQRGm
TLSH
T1EF5633DB5C4DBFD1E2ACC5374636769B1A6D01B02BCA3EA1CCE056DE4E506AC7B40A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appstep.58680017.exe
- Size 54.3MB
- SHA256 c2b8c7ce137757de1beb368148237f1a9683893d4c29b9f62d23a06d09d4eb3b
- MD5 b906739e99efe1667b0445b7379b815d
- SHA1 88c2ee2e7b5b3622e24676da3c2c140cfc4cc62a
- SHA512 1779ca60c06ccd1969b89a9518a0ac2d2a3e4722d0295e4d9759ed9f72e83a8ac61d9c4aa12127ec4be3ce8fcbcd53bd6961f72881b0ee3bb384486214693951
- SSDEEP 98304:Ru19nmtLsx4qV5+uY2cQysL8kxEVv4vu7PErGCrC9ILrFMKQMYpTTDliJW9PgAK:AnnmtLsX5+um3nkSVveZYzvsyPgAK
- TLSH
  T18AC7F90676028DCAE06692B4145BBF91E3B9FD714AF1D36723F6272D1FEA34C4AA3144
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2