d265d9d29c505a1fb66196b90089a4d9e93ca7a8fbf383fe037294b3394831f2

General

Target
d265d9d29c505a1fb66196b90089a4d9e93ca7a8fbf383fe037294b3394831f2
Size 5.3MB
Sample260724-nv79psfg74
SHA256 d265d9d29c505a1fb66196b90089a4d9e93ca7a8fbf383fe037294b3394831f2
MD5 cf9ad7fe8c44c8f23b65b56e802cc6a8
SHA1 5c0c78db608eb174577a142d2d0341fa8394bcf6
SHA512 59f71a4155204778e80f8ed1fe334d8e1c7dc2b7ddf88d22df35b7df08f7f59f29e776694e0463cd94bb0591a50a4f0dd8d24f4ac14178230d103ab0d3cc8af8
SSDEEP 98304:Lm77L+6LZPDmuHxpcreSOUem6SW3eslvVdyZAWWK2szRwXbuIL5YrHd:4+MBhcrelUKjv4AxKdwj+d
TLSH
T1BB46335A0830DC293534886D1F1D11BDDC2E3D869D6D6EE148EB4EEED03BBA527D3A60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intll.0.88017.msi
- Size 5.4MB
- SHA256 a108e0f56673c76c887ebd0da764cc541d5f38863e30ed0530acf4dfd18d23eb
- MD5 5f3444cc8d6471e830d016663516f559
- SHA1 63eb779e03a8437a3f2ce8e57ad099e35cc583bf
- SHA512 5be35ade0988773feb328a229975fd7acf53808c1eaba23ca50d845bce9fb6ca7f5f22eaeebf92d5f0a9e2fa3b35b661ac2622c51bf0635ab49397c7d02bc541
- SSDEEP 98304:d1iysd/wKv+CmcDyP4uM3LPhDgAHbXcj4SyAcU+SQBEkXpIcXWy2U3D6BJeIbvcm:n24w+W+yp/oj4rAAjzePyH6xOK
- TLSH
  T1994623D638966B36E14BC770894260ADBC6A3F45FF368D0E3DD93A141E32B2567B2341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2