b802f332fb833d263aac593b8285746a7ebb0f198dccbb42653656e90b4bf32a

General

Target
b802f332fb833d263aac593b8285746a7ebb0f198dccbb42653656e90b4bf32a
Size 5.0MB
Sample260729-htw76axfjf
SHA256 b802f332fb833d263aac593b8285746a7ebb0f198dccbb42653656e90b4bf32a
MD5 333afe33c6be371bd07bfb5a0f6a0c2c
SHA1 325b528dc0fdb13a1910cf8c4b290b20b1b147d4
SHA512 479033b792f5529d7e1b90c4be2078aa5d6b51f195cd997bc85349153521d3e97c8420d37016b67eab6aca25650ed9019a29688c6ca98c19b39aaabaf269bc16
SSDEEP 98304:7WK2AvnPMLC2WAyE276mhR0C6WWcPHUNMqAhojtZWNNIoDPyaoj72RU/QG1TF:7WK2AvnPiC2WAyE7mH0DcPHjqAOj7WNw
TLSH
T1ED36334F697F4283A53B78CB48CD89E48E34730A37BCC9584D32696D92B6B5F4CE1099
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n008.msi
- Size 5.2MB
- SHA256 88282fae7edae9110f06242089ca63c329ae4b61dcca3b7ef2addb43e4b858c6
- MD5 3b022aba7abfed31329f1fced9c14288
- SHA1 5d9ceb5344cf7cca26264b07dc16088d90f8decc
- SHA512 1da95ea1c73b474d4dc75d53e0ba518cee93633aeba3ded106a1068d424e9c12517e562da499cd4a6d09c48529da3aac01fe97fff2e78d69e9caebdf756d663f
- SSDEEP 98304:RIB1wodeTLsU8ESG8r663tiwGWUcBB2fAOsho+N1XBAyYRiD5iS0tMfSLYD2GrHQ:RG1msU8ESG169ihcBBZOsOMXB8i9iS01
- TLSH
  T11A4633CA7CDB5732D09BD7B1808726BD71393FC67E7A4C067AA93E080E72B1954B1285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2