7e833dda6751c1b5b1199ad09859cd0487c11f2063d0a4a8f64f295b5d36e001

General

Target
7e833dda6751c1b5b1199ad09859cd0487c11f2063d0a4a8f64f295b5d36e001
Size 7.7MB
Sample260724-plxbhsgb59
SHA256 7e833dda6751c1b5b1199ad09859cd0487c11f2063d0a4a8f64f295b5d36e001
MD5 e3e380bc5b26ac53793655db180bed33
SHA1 6b4055a85f113df74896d77b536f68978545612e
SHA512 646951db44023d4708a30a84568e1ee43e83d8b12e55a335f01dac5b4941bdcce4bf0aa4c5ecbf00acf632071b296c9b2fda19a5447c43a83f4d49a86f6eecc9
SSDEEP 196608:6U0EZvGNNafBKU8BEs0IgUCcHmirbzRuD8OpCX:6xB6fBKBr0IgUhGirbd6VpG
TLSH
T11D86334D5FC9E8D06ED6905DF72027244EEC4444E13A820922B2709BA714EDFFB29E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intll.0.88020.msi
- Size 7.8MB
- SHA256 72834001ed7c5e2f46ac24f38884c9a577d2e8738ce699ee8ea4c0f9f59b4f24
- MD5 0e57b6339986362a384567c29361ec31
- SHA1 a1b0d1b0aba225db346cbb62157ee7517e873cc0
- SHA512 dd98821c322d14fa16059a1406f072674bef36d9ccfa75987bf492406b24ae9fedca27dc310426598594a5f98a8fa909989143ccf12190e1f1c997158d4f48e3
- SSDEEP 196608:l1x0mI1VyNra3fapU7jIFIsGCDSirx7XcLsYhKy:l1xphs3fapUjIFIs5+irxTuVhZ
- TLSH
  T1138633CD7EC97BB0D1C7C374E2427A2C7D197F84B6368D0A369478415E32B2A1336A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2