a17897cbe12df9180796465e4a54fb8d2dd6c82c8bc3a01e39f055e1e245e4f6

General

Target
a17897cbe12df9180796465e4a54fb8d2dd6c82c8bc3a01e39f055e1e245e4f6
Size 5.9MB
Sample260723-m7qpracb88
SHA256 a17897cbe12df9180796465e4a54fb8d2dd6c82c8bc3a01e39f055e1e245e4f6
MD5 846cc73b288af1d886eded1cc5a12d10
SHA1 86188ad18ab1f74c3ab9771c3c58645395c007b7
SHA512 4413d4c0938151f28148b0410263255250efb3dfc82a2ac9a2232e7e82203449f23607652f51f967831c83197c19f0accdfc61b47031f27b06861f0d98f95888
SSDEEP 98304:8RsUwik8NYPvTiFeaxLghOL6o5aqxNJA648Mnu7ajA9v+06nRyVzq2hS:F7wCHgCPIk5AZ9N6nRWzqf
TLSH
T1865633D710E9B63CC2212AC381A77632BB2DB209651E75EDA73C971D0C978D5E285FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup.1.0.2286300013.msi
- Size 6.0MB
- SHA256 097cf71b1d1022b59805001617e9461cd9616a6067ab11945a654a6f8cf3519d
- MD5 5e446c020c153a154de829cbf2509292
- SHA1 df64645c5b7904177c97ce50dfe6599ca00d8920
- SHA512 63c3f5883f7671091d07e0b62c41144d9b8d1426a0c6b91c395b7fe5d07dfb29fd8aab19b79000fadae674097c3606e35af5eac83292672a4834379f1ae71ec3
- SSDEEP 98304:wdkQougWhcP5dyFeav9aQQUSlSHWScRZUC6cxubOjKn1mEaTNytzS2D/:xJ0uBS1IUSiORumipn3aTNczS0
- TLSH
  T14C5633D23CCA2774C04BC7B28193757D7A2C7FC2BE2A5C5A7BB837044E72A5552B1682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2