1d8e2560478cb779d9ba4d89565a6234f8ba30637778514f423df9cf530c58eb

General

Target
1d8e2560478cb779d9ba4d89565a6234f8ba30637778514f423df9cf530c58eb
Size 6.7MB
Sample260724-katc9swanh
SHA256 1d8e2560478cb779d9ba4d89565a6234f8ba30637778514f423df9cf530c58eb
MD5 7c3ae7f501d1b996f68f8744af56ff6a
SHA1 650ac5c7726df5e43de229ef74bce2bdb4831d73
SHA512 276c5d7d6657860abec156ec0e60eae4dad310716717a77c0f9a64bc7a92da047aa041225cc55f692e2c481d7005bbb03397e0e71ed3fe8f79bfcd9fb96e2aa9
SSDEEP 196608:Y4RHXEAHwAH7uetNjhGRQIth7uwQ6PQRBTgWxR+:YmHXErACetWRnLCbTUW3+
TLSH
T14F6633F8D1ABE6E4352A48CD79399ADF09A7FC190EE4D013796830105AB38BE53F5067
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intll.0.88009.msi
- Size 6.8MB
- SHA256 34df15da25a5c365355a9a0e7e5b504253c1426b09ba6a4371ff15b2ca762ead
- MD5 6a195d80a168f959fdd38cfd40aaf5dd
- SHA1 cff0d58da4852405ad42bc69d3bf6237cfffa397
- SHA512 2b3ce46ce97822417fe853abfb100e9b3cb66efaaae541f1a1c09c318c2b596740c51bf69fc532b260f7831625b725064cdcfc754993843c3703aa700dc796b6
- SSDEEP 196608:04pNvI6xjQjH74RrZMiDBsEjDryAo47shFX4KPfi:0kNvIuQjERrZMiDBdnGjzIKXi
- TLSH
  T13F7633D074C36B31D08BC7B45527A5AEB12A7FC56F768C037AD832486E7393A11B9386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2