e35112ec0181b72d518c40a89372dab9c796f32c03f41e6b789bf1d88c2af71d

General

Target
e35112ec0181b72d518c40a89372dab9c796f32c03f41e6b789bf1d88c2af71d
Size 7.5MB
Sample260730-dqq5hsyblc
SHA256 e35112ec0181b72d518c40a89372dab9c796f32c03f41e6b789bf1d88c2af71d
MD5 7db7023ae2facaaa0e842c7b70037e3b
SHA1 83f3a15ca9d934d3b928abcde21df47cd035f139
SHA512 ec6e563c7447652d2571cd808ce47a21bf7dfc42bdbaba6fba772d4b5680d5660e0b42b121c99b982304ac18decd627506796a78e4d4bc0fc85d1a5c477407e8
SSDEEP 196608:LsaV7sRCtVqd5v+0WbuPQfkjcnD8kJYi5HEpFLpY6:A1RCqd5v+0CS0AkKV
TLSH
T1DA8633154075685C1E303AC05E5B0BFF7AFA0648AE6EA98C47B5C632647D2F8C631BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n004.msi
- Size 7.7MB
- SHA256 9eb20f69bf98a1e0f694c668f9adf6b781b995a8b9542bb1f6cdb5512c397c6e
- MD5 1be795ad389f52b1f3f539008f6a9115
- SHA1 a485f35382ce4bb06a8060c3e813933a2a039dc5
- SHA512 a7fa23b155f8c6e9007d369edb515d66835a99cca81ba1800a66abb143727c5637ba2fa36015b935e9e83e99f907d2e219bf50e8cd79ff70085e41fb9811df36
- SSDEEP 196608:xGbukNfmtyxzmdV+HCNIL2ghIpo7h4kVg2prApXJTgJ:xGSJty8TaCyLA+Ckyy
- TLSH
  T109863399349A3671C297D7B02953257E7D6E3FC4BE764C1AB79AB6102C32338073136A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2