ed0b86c8c6ceca63b5684a4ff2c75fbec024fba39db0742e5a95f86f69622e04

General

Target
ed0b86c8c6ceca63b5684a4ff2c75fbec024fba39db0742e5a95f86f69622e04
Size 5.6MB
Sample260730-csp5kaae49
SHA256 ed0b86c8c6ceca63b5684a4ff2c75fbec024fba39db0742e5a95f86f69622e04
MD5 ff2bbfc22b03ca8d51b5fccce290849f
SHA1 5d984940c5f37c3fc0003ad7f2e59a8ef242f821
SHA512 b7edef745c05c2460e4eb0b3f9828d49e4ce6ed2b36cec4ced56abdd239aa363a84adad4d8853da87a87b40e974eb1eb5d0df1314c69561da675f11fad2b608c
SSDEEP 98304:ISXQ63arw5jmYiKXBSiB+AvOiSSAHsKrXzSh9BavCzrm7RppLu:I2QSMXAmxSgzfpSr8po
TLSH
T12A46331472FADA647471EDDC7E7E5B4261F76424D824D76E827039F3AE10224EF9208E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n002.msi
- Size 5.7MB
- SHA256 b40c21601d2c40aa039e2bd385c9a3e7a66480a186209b108e40d32752e31517
- MD5 ccb40802bb00e44dcdb0e702acfc90c1
- SHA1 262869384a1cfc9e548d1c898d7bd17c59616d91
- SHA512 adf715bd235d492a3b6a27b300243306e6d72f414ee457a8fef2116cc23825e70088cb5094a88265dd445664263ef3b130ffc3891eb9939cd4eccc012afc5580
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlQ:8dCis4BEoZJLm4Kv8w+Gzere
- TLSH
  T10A5633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2