b6e161e905c6341cc94cf44489c17e14e877f2e88022cd35796a5d977cddd368

General

Target
b6e161e905c6341cc94cf44489c17e14e877f2e88022cd35796a5d977cddd368
Size 5.5MB
Sample260724-epcfea1wct
SHA256 b6e161e905c6341cc94cf44489c17e14e877f2e88022cd35796a5d977cddd368
MD5 7a58ba44161eb80323d99bb8be5a7051
SHA1 9385d0610789d5c310397abdadd3b54744db3bb7
SHA512 d00a460a00a044dff478f7d9a8caac6a1fc75136365941fbefbb5a8edbe930456cf8d3f63184b543c59480268127397f3da73e96e4710c99bf910b3b7677ada2
SSDEEP 98304:j2JeBsuACoyp1oV+LEpGcWOfENg5dff125IscPfO/7llb3aSpjU7sGrDUz7B5PAJ:j2BCbCV+sKSEEp92isc3y7ld3aSpj08i
TLSH
T1544633AD420B5564212244FBCF6909C10513CE3CE68EA48B77BCE1EB8D7EB5FC45ADA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setinst.2.0.63550023.msi
- Size 5.7MB
- SHA256 14a26918769ba9381d20654a9ff712806a33166115dd9424d70c950a2b146ff4
- MD5 018a9ecd1feb93bc5580471d9a2d14e7
- SHA1 ad4a6b16d3adee34ad583d3312be986e4285df97
- SHA512 a1c3668eb7a42ea26201f592845b0223c7afa550ea14df02d0f8a32fac8f8c9392e580eb6da30a8d0461ad98067b87ad42e79cfb2f433ed11801d6f7cdc32d3e
- SSDEEP 98304:qmHoZYqAYoSZ585ElcDicWmDKNW/339E4cnhY7khI/tm7pDyGdnCXPdtjKgMObct:qmZYty5Emu8KUnOFn9I/tm7HsXPdMdQY
- TLSH
  T1BA5633D068CA2370D067C3F18656A67D711B7FD8FE639D0B7BB8B6140D7662849BA380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2