4722c43d48161a63cc7f53fae77146040141152e7584ce51566215330744473f

General

Target
4722c43d48161a63cc7f53fae77146040141152e7584ce51566215330744473f
Size 8.5MB
Sample260729-qeb8fagh48
SHA256 4722c43d48161a63cc7f53fae77146040141152e7584ce51566215330744473f
MD5 c3410228506f62b8aa9f8043d83d9a15
SHA1 e66db91d1f7f167b72160af9f706319e4dcfd66f
SHA512 d07f0f21d3f6a4044fbebf9f85a79042a7a13a646a8b065b1b20831e9b464423cb2eb03be3aec8531923a118d1b34b2859efed98f9981dd44aa97831a4303402
SSDEEP 196608:33OieBD8SUBZwTL7iPbgwDyHg0EdzCQ5kN4UTnLv:3KhVUBKCgrHgBednT
TLSH
T1B296337F6A0B80D9D9DB24AB8905F9B18304D0DE1A828FB8790F7D1E98C94435CB7E75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n019.msi
- Size 8.6MB
- SHA256 70f2e89d60de401c273f413831581b28b41e6dfdf1678de88ada78f73d15f263
- MD5 41acb20c677a5f3a1b3f5d271e05c9d4
- SHA1 ccc63a8aadb10225474d1ddfd4692e00e6b401dd
- SHA512 73c7d06d4aabd87f0ddeadec47ff7d0f457d7e49609211e0dd321001d8962b91157484b19e2a10d62f2f6e8d82a19175fd2b6c743ab1af9157126576e5bab9e1
- SSDEEP 196608:4DPoHyBL2NB7i7z+cwih17wgQRnEAnG5keZbuA:4UHyBSo+Gh17wvGdbl
- TLSH
  T1349633AAB98B67B0C0DFC3F68502B07D76183FCA7F624D1A7A9D3B080D7160155B6B18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2