58089805bc4bc900209eed7eec0f375a58c28568f99804082f5157b4e2e60af4

General

Target
58089805bc4bc900209eed7eec0f375a58c28568f99804082f5157b4e2e60af4
Size 5.6MB
Sample260728-vfdvwa11ft
SHA256 58089805bc4bc900209eed7eec0f375a58c28568f99804082f5157b4e2e60af4
MD5 e93b2f7512244e2cfab6b179bf7a6c17
SHA1 8a93bc85a85c231c036a2a1718415deec3a431a7
SHA512 8a330875c72a6e3b99d4516438e2302b734b20fc2f4655e75cd4e83400010e3fb4c89dc96a5188f2ef979d64c79e094fcb393f9bfdc9c3a173ca15fb5ffbb547
SSDEEP 98304:w/hOUsM6GtgI+9m+mZApP9CXkCTA2+dE97jDJdHfL8JfYZQXbfU2U/OhEL:wgUkIRsITV+dEVDJdHQJQZQXbfUcKL
TLSH
T192463393CE2A9C6C71153F9D847D7898203FA14D4CE218676AD89C9EF31CB93167CA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n006.msi
- Size 5.7MB
- SHA256 c1d1d8cd77eb88a837ecd8eab3e562a466948b05eaad0be256c03fa4b58c45c8
- MD5 50b436d8f68ea9b8144ab4d62c6669d8
- SHA1 5e10c06a2c2d709ca4bd36afe2c2206d9ad97c83
- SHA512 61e56c1c2a6d9a1fd723a052f4e2c80a68addce59a41acb1f76c2bde67a11a57626af6e6cef4eb5feedb311f1a4cb4ebfdfb141d91bb854fc32f068402769838
- SSDEEP 98304:S8cgy6clie+JgyKLMpph2Dou88gnXVDhP9paXrh07f8fafBdYGS/ChEy:tcyeLo8Db88gXV19paXC70fafBdYwKy
- TLSH
  T1205633977D8A6778D047C7B9805271AD301E3FC98F724C5B3AD87D4C6A3AE0518BA70A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2