a2289df1c8e4f67285160ecbe7ac45f9d68726a3d64f362e498c1393fccbc922

General

Target
a2289df1c8e4f67285160ecbe7ac45f9d68726a3d64f362e498c1393fccbc922
Size 7.4MB
Sample260728-m2fycsvdkh
SHA256 a2289df1c8e4f67285160ecbe7ac45f9d68726a3d64f362e498c1393fccbc922
MD5 bf9842404ca55e80f79a4c0a41a61d9e
SHA1 f010cc08f2be7d6926ad1849dc7348388e2ab17e
SHA512 0b94791dcd011a86069b0233f91629d7d2d009b4e06c3cf64aae792378c4fea4570a79ee9b6cb2dc88b5cea1cbe8422d70912788af2cee8867a9de18e61de936
SSDEEP 196608:RVIvVOMIVzyZcE41kP6jFGBs/TiLUzWumqftqJ8hZGiFM:ovVOMIV0cE41kP64mbiod/0GhZ5M
TLSH
T1D676338B90B330152E91021497AEC0C69BD97C382B56E543FD1F74A1D78F7ABADA64C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n016.msi
- Size 7.6MB
- SHA256 b5e8e73f7a3a3045704e869395d3ccd726a67e5e1239b2e5be3c7de9c6221e6b
- MD5 63e2991d448198cfd2713c2923fe478d
- SHA1 ab3c219b1763befb044624b4e6ed80eb1cdb3ea2
- SHA512 622ab962da892c903abde3bc8d7ee3d1e60aabb7538c75cfb8f3251ffcf6b1dd32d432327fe586e48db28db6470d026b68e973679e552512305e07b16bc7f581
- SSDEEP 196608:abHbJEFnpsQyLt2ZwUGtmGc3uk0C9bW3i7WqIYht6La9lwGrp:a/JEvsQyLmwUGtmG6ukjFWSrNku9lxp
- TLSH
  T11886338678D232B1C587C371869BD89E7E283F903FA3CD12B99E35110E7773A5676242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2