8dab5e6f3f8abaad1935b0cd7889dd624a3fe4b8bab9331e5f787d6d9c555420

General

Target
8dab5e6f3f8abaad1935b0cd7889dd624a3fe4b8bab9331e5f787d6d9c555420
Size 5.9MB
Sample260723-nddzjacc78
SHA256 8dab5e6f3f8abaad1935b0cd7889dd624a3fe4b8bab9331e5f787d6d9c555420
MD5 2a1be6daee5b3c17a0ed1a23c6fd226a
SHA1 395205fafe787d1ede4ec17ccce23b5596d4af67
SHA512 29811ecd561a3c20a3927615613e876c1ef31b2f0249bc85edc6bc6baa5d082f5715d52876ea2de2992c63194eb998a0800d39e68b9dddcb2e728a0728782b2e
SSDEEP 98304:VIfnRfi2sTX/E8R0D+FI2a2K5VhYm3bfFwqgHq1AhwllEB52pk30kIzPVUFibCT:uRqZQgP0V+E+pq1A0k32PwD
TLSH
T1FB56339A39533BA10D5258409F16C7510530443E97AFFFDBC6C8A6B4277FFAA186E328
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup.1.0.2286300010.msi
- Size 6.0MB
- SHA256 74935768d39734d93628b3c719821402062c1f0fcd0b6dfbf2c23cdd930dbfa9
- MD5 8d25b3070d08501230e51f918a1f23f2
- SHA1 9220fea25021f85d91c565600f233d8f5b627cb6
- SHA512 e11ab0734aa245204f900023a326ef73789757d8310ba82ed59c77ce80236ec84b72390014b7e4c798e3446719923afddba95a0186b90650616785bbadeda1bd
- SSDEEP 98304:B2eIGBk2059/iqFEPcFsQYCKZ1U3C1pbnJ2pOBhch1oWtvvctUj7cD5Ilk7c0uzq:4eIGarGoB+1U3C7TAHtvvc2k70xu5
- TLSH
  T1475633D678863731E443C7B19613226E31383FEABE7B8D4B66E87A101E3772955B9304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2