90a72acbf99c56cae9ecb3e0fc4fac32c4151790c3918121c162f8209b4ca49c

General

Target
90a72acbf99c56cae9ecb3e0fc4fac32c4151790c3918121c162f8209b4ca49c
Size 9.5MB
Sample260722-dle7fsxgkh
SHA256 90a72acbf99c56cae9ecb3e0fc4fac32c4151790c3918121c162f8209b4ca49c
MD5 cc2f981009b8cff9c8f75ef19aecf8a5
SHA1 a6196158d1198478bed5c33e07be97c1c9cd024a
SHA512 1aaa5149fa420d8fc14cd31c84291445fe61acb13f3e1de55247dc567906c4ea3c276e253e975465f294547c92ddc2e02c0ed5170181be59c08e9dea36503e91
SSDEEP 196608:doSkx2XjIh+WMC0en/BOa3J8rpX3uWThOiUGqGvLM8mUWlv3ExmF6ZOa6sE2tdhy:ZkTw4ZOa4pXTOPCrBWam6AsFvTW
TLSH
T1ADA63390E86CA67DB1C8376E794875FDCF0FF84D069489D294DCCE6146E95B0B30A2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup.1.0.2286300021.msi
- Size 9.6MB
- SHA256 40c1332686601aca185f11184a7b7013bb0df4150319aee05381b74945e8959c
- MD5 f866985f12eeda933a7e06625184eae5
- SHA1 7ddb0154939f809efe35ed31f7aef098dd3b7052
- SHA512 c4f587605c48bdb732a97c220a0a45f0673ad4431266f32c455f4110980841c73f1ca1be9b55935933a676706e0de74bec4d492575d0cca58b7d7af51a669a5d
- SSDEEP 196608:qI92DlIp+CK4ceVdZGeztvFAaL8H67158sIGN50y+w4D3HOX2RE7OA2gU237Zn:qI9aQZGez92a/4EVn4SWEWgftn
- TLSH
  T178A633C1F8896370E0CBE375590278FEBD1EBFC9B666484674E83A415BF26252376381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2