939f754f13cab9843b98e1da3e035baf7837aeae0768f4d0c6ad3da7fd5111b6

General

Target
939f754f13cab9843b98e1da3e035baf7837aeae0768f4d0c6ad3da7fd5111b6
Size 5.6MB
Sample260729-deebksfn2w
SHA256 939f754f13cab9843b98e1da3e035baf7837aeae0768f4d0c6ad3da7fd5111b6
MD5 a024f3cc1d4698255b02a047b42dfe40
SHA1 caa1f92223ff5c0edc0b4a7d2138b120f2477c71
SHA512 f9fe4e54ae0906272052d74d438785d4937ee2145d13a427cdde42c420cc6f3e5bb9e3e9f66a91f4db80a187c63fd5d4f35b7d945155018b9e7d5ce8404be7e3
SSDEEP 98304:GSXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLz:G2QSMXAmxSgzfpSr8pt
TLSH
T179463314B2FADA647471ADDC7E7E5F4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 782b3506de23ec97c92d330e351e3c2291454171c88bce5a59f3dd51cd7c65b6
- MD5 9c9023a350337f91cd1d5fadc7635a76
- SHA1 5982e53d4ee5a059d8743c6923159005b657b49f
- SHA512 bab4a3c86c2bf047016a7462d44d8bd7190cc2e5ec4b31ae9fbca084efba140b954239d6fa2e015a7fafe7faaffd1899879bdeebdb35d9083ce530be5f3acc2e
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHll:8dCis4BEoZJLm4Kv8w+Gzer3
- TLSH
  T13D5633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2