d454a66cfc4eec9dc83618a63a89046da4ca45f69567fe8f50853af34e1661d9

General

Target
d454a66cfc4eec9dc83618a63a89046da4ca45f69567fe8f50853af34e1661d9
Size 5.0MB
Sample260729-h8ftqazzb1
SHA256 d454a66cfc4eec9dc83618a63a89046da4ca45f69567fe8f50853af34e1661d9
MD5 539fd3c8f6823a015105b5eab73d2ade
SHA1 a76645823bde195e5017b74d3edaf1b6eff0b762
SHA512 7bc89d2d53e9682a16d6e62a95cbad1243a43cf993abe5f70d824c8de52ceead427648f565bbee46c92401a8bb565621c460a2bbd9cb20cfc46bba565a2fb540
SSDEEP 98304:RWK2AvnPMLC2WAyE276mhR0C6WWcPHUNMqAhojtZWNNIoDPyaoj72RU/QG1TY:RWK2AvnPiC2WAyE7mH0DcPHjqAOj7WNN
TLSH
T17D36334F697F4283A53B78CB48CD89E48E34730937BCC9584D22696D92B7B9F4CE1095
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n008.msi
- Size 5.2MB
- SHA256 64e42e918628d5f8ffa6b1fcd0ffdde9fb16100010df6f9b946e985034125e32
- MD5 d9c0bf3fe4274fb2d5341185dab663c0
- SHA1 f8d2486df065a210a56d3d2953d0ae27a971f210
- SHA512 dd00a48c084721ce88fd97bdb44c6cc5da8a402f9cbae3ac67a787fd0c8282cb830c7d0c2c7f0ada765069d73460436532dcc339c335cc8cf0a76f9b3216a107
- SSDEEP 98304:RIB1wodeTLsU8ESG8r663tiwGWUcBB2fAOsho+N1XBAyYRiD5iS0tMfSLYD2GrHQ:RG1msU8ESG169ihcBBZOsOMXB8i9iS01
- TLSH
  T1FC4633CA7CDB5732D09BD7B1808726BD71393FC67E7A4C067AA93E080E72B1954B1285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2