f89ca3fe19778261c9c78861062fc51c51a0d0c8dc458914d13f1d8934b2a277

General

Target
f89ca3fe19778261c9c78861062fc51c51a0d0c8dc458914d13f1d8934b2a277
Size 5.6MB
Sample260729-15xbeaff95
SHA256 f89ca3fe19778261c9c78861062fc51c51a0d0c8dc458914d13f1d8934b2a277
MD5 2fc0df0f4cde1bed34a614fd147eb2e1
SHA1 e92b111b7d8d0b93e04537ba30d880330bef6e85
SHA512 4a76cdf59bdf9ad1bd63314c4f2b8458ed59ecd3737271d212327f735953db292a1d3dbb524101410a2763216713ff924a4c83a6a842cf0368c4139c3567a18d
SSDEEP 98304:fSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLr:f2QSMXAmxSgzfpSr8pN
TLSH
T16D463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 3ad8752ebca192be190b325a640bfefd51a3f3dd9e9cce8d8f38b550cce5c86e
- MD5 c13ee687d9224b6d36ef623b73e2a9ac
- SHA1 ab74cd0f1a6649a8bd0e3fbfb118bbd5be6384dd
- SHA512 928a3c9b323dae2b7f40b87e35a14c2db02d5c73c849ddbe39b6f90971aaf91873993857690f3ac8a652f81af2322c938c9f9d31879b43522bb3a859b0c9f234
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlT:8dCis4BEoZJLm4Kv8w+GzerV
- TLSH
  T13F5633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware discovery trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2