cb9f95c5fbf619ee122d73b02f8a636a7f1cdfc588195dd4d7550dbe69dfc274

General

Target
cb9f95c5fbf619ee122d73b02f8a636a7f1cdfc588195dd4d7550dbe69dfc274
Size 5.6MB
Sample260729-dgm2hafn7s
SHA256 cb9f95c5fbf619ee122d73b02f8a636a7f1cdfc588195dd4d7550dbe69dfc274
MD5 66c7bee289c70cae7c5a608daa15cbdb
SHA1 4414fe67f033116d377abc66fd8b9e4d7aeb7528
SHA512 793a446fab5a9f205528bd6f7a3146093927a9522e6d822072521557e6753fe6126d4e3bae45d4d232ee1f103dbe2268ba1075a9923e44a709778a884c5a40b5
SSDEEP 98304:9SXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLf:92QSMXAmxSgzfpSr8pl
TLSH
T177463314B2FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 9fcc8825b0019cd909df7d81ef3ce846eb097e7e6f0e98bf3ee8e4cc65974d74
- MD5 df9abd4c813ad1b8fefb9e256149c77d
- SHA1 c4ed8deb3c4d1291feb0a6589932cb4a45fe6ea9
- SHA512 c8c6baac3c8a9d742dbf93574e74bfe9d013f0c681eaa3f51c39733d853cb3f56bf133ce78a86f360e653103159be8c2d9f38083e8801cc8d8c29e64a49f3776
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlJ:8dCis4BEoZJLm4Kv8w+GzerH
- TLSH
  T1CA5633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2