643aae9b0c2d176c5e4a17e0862c401f1b0b000d49d7cce878db318aa6654bcf

General

Target
643aae9b0c2d176c5e4a17e0862c401f1b0b000d49d7cce878db318aa6654bcf
Size 7.6MB
Sample260729-cdtt7sscja
SHA256 643aae9b0c2d176c5e4a17e0862c401f1b0b000d49d7cce878db318aa6654bcf
MD5 87e5301ae2c1f2188da9af818fe61842
SHA1 c523930215522be25a861cf67779c1a19b56834d
SHA512 33db2beac57454f7f0912a86f5dbbd82043ef2538356eadcfef54226110a064406ce84eceec566d2302500237598a1601eb693104f2dea3899f9dd0cfefc47d2
SSDEEP 196608:3eiGfjMj9inlbKbCBBkv4KQenPPzQy1t0PPnXLUq4ycrRtYsIeLcdiUDm:3dgjMwlbKbC/XKV8cm3nX8ycrMsIeLcm
TLSH
T1A88633C3E991A0C9FDB2C0F88BA7E1F2C5D2C18E1C4E65D16DB094B11B8715D7CA9E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n001.msi
- Size 7.7MB
- SHA256 dea835d41fe8bc994371450f004e4317354c1c27db4561720a430be3deeaec9e
- MD5 3828295ed89f9a2c4f3ce325a460752f
- SHA1 550ddd2412280895513fb56bd214eaadce496233
- SHA512 6cb2b58de0220d7508a16907a8bd78158a4a2f5352091c04580a9a6345961d3650118ea163d81679448cc9be6bd8d83aa2cef2869b1cb1a38bba038c2cb017bd
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWDW:nAGiNMwnbQvQTyhv92ALhve0ETWI8Khv
- TLSH
  T1528633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2