a87067af14000f63a737afe86238f58ac72c1c83d0704f1fdabc421a44962903

General

Target
a87067af14000f63a737afe86238f58ac72c1c83d0704f1fdabc421a44962903
Size 5.6MB
Sample260730-h62cmswyht
SHA256 a87067af14000f63a737afe86238f58ac72c1c83d0704f1fdabc421a44962903
MD5 0b55e3f250fa24798800b5df715f3a08
SHA1 2588763557b80ee42519a477ed4fcbea16757e46
SHA512 a48aac44f2ed2ef661ce07e705754acbf419569d5ad4a068e07969b9eb84058baf97f0cf939edf3b575e679d558b6148aaa94509a12fdcf762820035db5e276e
SSDEEP 98304:R5P59v/23FLRDPDK0J1iUbgtFJjV9nPJIXJM0J5WHI+9vlhrE0owuHmuZd0m/1RF:R5R9v/gBRDrK0J4FjV9ni2Qb+9frtuoS
TLSH
T1525633F707A5D30549558B079C28B27E8F44EE86D7FA33269F767AA32469403C93E348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8006.msi
- Size 5.8MB
- SHA256 b4b3255e2218c0e77fb166a367621470ec9b2e5a20440f64566f05cdf2b0f54f
- MD5 bb4304ab8450cc7a04d3dc9f1c392140
- SHA1 c3f5cdaf14ddaa111d39c9b6c296da6e4376fb1c
- SHA512 3a543eb9bd383e4936adc6c3e551a5fe3afb404b3541f9d3de1244a4c40e5d203824e23147330e8e7290bf4aa01cf0098c0923e15f1430dfb7e6b5d4c1395094
- SSDEEP 98304:nojXur7EW9pPgeT1iQLgJF59RVzPtI3zOsXluHealD1qa52o8Mg4OFDSq/bxpqVW:nOuXEW9pPgeTyB9RVzeSIFalDlEo8aO5
- TLSH
  T12B5633E63ACA6335C06BC7798051216D72583FE19FB98E263FE9371E1C73506687A384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2