c4d653db9c1e90d71974a44985839666b786913e9269cd75cd14c9f2dd9ee4c5

General

Target
c4d653db9c1e90d71974a44985839666b786913e9269cd75cd14c9f2dd9ee4c5
Size 9.7MB
Sample260729-kkhdrazcnd
SHA256 c4d653db9c1e90d71974a44985839666b786913e9269cd75cd14c9f2dd9ee4c5
MD5 3ff716b4c9e49ac6471f2fce152c2810
SHA1 6c816a5c33778418780bff0fab7fa19dfa305f34
SHA512 72815060c835555227ec16882a29e7689994efed34ea25c5fcb22ecc5acd25f1243288b0a0ede7afacb0bb7a2ba22239ca1767d4ddbcc010c8eb670636f838f5
SSDEEP 196608:uAJMRNOVFgp1O8+vY6PX31DAEQAwpA+pzlsZZxeAJJy60+VoMh/oO:uLRoVFgDO8+vY6PHdQ9etTJJ5ZVoe/l
TLSH
T16FA6337EBFA23F8FC408D86BC489118B45BAC08DD330F5ED4566C86AD2475A4772A879
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n009.msi
- Size 9.9MB
- SHA256 2e53284c759bc5a1eb951f28e9f7aad461d25bf0d58702bff3dd582be82fc7b4
- MD5 450e2060a829c4a0fbaef5c8370f3f53
- SHA1 3307886bb2536ed77774415eab8588b0515c7c50
- SHA512 79ab03abd9d2028abcc263f7f9c1c3ccf3863d47b5d8b8efd23b425e43012fdbaf85f60d0801181ec833c0189a00d8775ab3a7269f0d224a8c76175d2e36e3b4
- SSDEEP 196608:4Jo9NyvZGBpsXoC6TopnZZsSsDKEKEsTyMXpjinfLQ0LnyrWSp80nHsJ:J9YvZG7QoCTbCKhGTjLnALp8SH0
- TLSH
  T13CA633EA3E833B3AC00BC7B24146612E7179BFC9FF318C9666A9791C19736203677615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2