e62328ed038f834e1dd89b32fa2bbae6a4229054afb57c8cf3b748e5a541109f

General

Target
e62328ed038f834e1dd89b32fa2bbae6a4229054afb57c8cf3b748e5a541109f
Size 7.6MB
Sample260728-2t359abl8y
SHA256 e62328ed038f834e1dd89b32fa2bbae6a4229054afb57c8cf3b748e5a541109f
MD5 30d06b26c339ce0071d99b55be3f753a
SHA1 35e775e5dae2d4a7358d3e78df9acc3bea181d63
SHA512 74e301504e321c076242d161385aa2f5fd1fb26cdb529cbba5ca53af2114eff5cffd2bc8953aad5a3c7c830516568a55a9c3cf429159d69eb06926351ae8f014
SSDEEP 196608:KeiGfjMj9inlbKbCBBkv4KQenPPzQy1t0PPnXLUq4ycrRtYsIeLcdiUDO:KdgjMwlbKbC/XKV8cm3nX8ycrMsIeLcO
TLSH
T1488633C3E991A0C9FDB2C0F88BA7E1F2C5D2C18E1C4E65D16DB094B11B8715D7CA9E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n001.msi
- Size 7.7MB
- SHA256 54d25ef05695471b1831f7b84fe7424bf3953cc396c21d1190634afb9c441bee
- MD5 e1593fe44982d62c74f9303f91ea596d
- SHA1 1775534a4ad9ac5c24bdcedff944763c4c9b486e
- SHA512 79776f7295c215b82f893c78bacf91a0ddf2733cd8ace82802685a210f426118a6eaa3285d408c087bf3d233d34784350e55ebb369a0112209025cb4e99a58eb
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWDg:nAGiNMwnbQvQTyhv92ALhve0ETWI8KhZ
- TLSH
  T17D8633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2