c773f275844b2711ffb7319cd996d612e7f259635a6d0d6c97a8cb69619bd0e9

General

Target
c773f275844b2711ffb7319cd996d612e7f259635a6d0d6c97a8cb69619bd0e9
Size 5.6MB
Sample260722-j74d3a1gre
SHA256 c773f275844b2711ffb7319cd996d612e7f259635a6d0d6c97a8cb69619bd0e9
MD5 2d9c18482553e7dea42fc5a6bab92753
SHA1 25838bc93d14f7b1ba2f68926736f35d58721321
SHA512 d67c6eef729b8d039a6d890979800008dafcd1e3b0b735c0ceae923e32065c6a79ffdcb29f7a31061d8376d8add86e264ce06b4359aaa80cd52a764ed326280e
SSDEEP 98304:fb5XFeASGehsuR9tEUNds7wFy7bJ3J+Yj7yAGtCZJYLPMggugsEsru4lmDDeTlw4:FXvSAGdqQA3j7y+ZJYQv+ruJXeTCO
TLSH
T1794633CD70CA932E84DA8ADEAE260F644E9471D410ECD2E5BE2630D93518335DF77A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup.1.0.2286300006.msi
- Size 5.8MB
- SHA256 0f992f507a0d841a5a27f91fed66c611e430461160e7ebfa3143f18fe56cb8a5
- MD5 abb4a7d4abbab10248fafe1e32173250
- SHA1 30b079db09b1d5b19ff39f87b7e257fdf1702913
- SHA512 e22d768cd3c3f7f62f42bbce921fa07e08164ce227f896d4324273d49b0d14a14fbddc7049f10e9e5fb83f19fb7ef0444d2bb698da9b74da6077621dcdb0d4c2
- SSDEEP 98304:rvwTUb+qIIWFmmPsEj9N+GFtAbwdy91J/v+IEhignvGuLTqxuMC2kP8s7AzxWXTL:rXbGFaiPA02DEhigvDy90P8d1WXe8
- TLSH
  T17E5633C978CA6775C097C3B5A102262E72287FC5AAB69C167BF53E0C2E3371505BB385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2