77773d126df4c30f5e6fe4dcc810da6ba968a4186014ece50ec82497545f25d6

General

Target
77773d126df4c30f5e6fe4dcc810da6ba968a4186014ece50ec82497545f25d6
Size 7.6MB
Sample260730-hebb5sel5x
SHA256 77773d126df4c30f5e6fe4dcc810da6ba968a4186014ece50ec82497545f25d6
MD5 bcdd6a1dfae03b6bb10a901ab7517ddb
SHA1 7bfe7045d18fbbec3cb64c0e1cc438aa42099553
SHA512 25b9d214ba8737dee662e5b2cea05d318b50ce16cc237afe78fcd75c966d18592cc2de79443341b93e5a4b0bf66657d3d4f24919d1e4218b7a295eb27740613f
SSDEEP 196608:hIriUd3n3NdrYv9Bj6UxxWh//dVUiK+rviQJ6AqxP:hIxdNaBjjxxWLLraQOP
TLSH
T1788633AA7D1F0DD110045F4269985D3CFAB268D2D2189822F23D7A2F4E336399D77CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8005.msi
- Size 7.7MB
- SHA256 46c58a119174ffbed8087265c1811ba0d637f36de754dbf13b4e53ff51679cf2
- MD5 8d3fbde3f579345cca440da88d6549ef
- SHA1 1e8d0f0d4ed755b2060e5902ba67e924cad8f2fe
- SHA512 30d189a0c679ca8c141dd69e610db98fb68bdfc24a8bae3cb10daacb8d20de91d8169b429def89b59fbd222ba537f199920ec68c358d66240b7124cbacc9d401
- SSDEEP 196608:ZBN9uhdNnvrjJElzusmWA1lB7kwKCtjE+Fc2Gv:ZBajlEeW2nRo+Q
- TLSH
  T15A8633D67D8E1BB0C157CBB04246793CBE693FC1B6A68C12B36839141E337269A73758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware discovery exploit trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2